What is the CVSS score of CVE-2026-5901?

CVE-2026-5901 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5901?

Yes, a patch is available for CVE-2026-5901. Update the affected software to the latest version immediately.

Chrome CVE-2026-5901

EUVD-2026-20725 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-04-08 Chrome

GHSA-jj38-mp8f-h2ph

Authentication Bypass Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

3.9 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

6.5 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20725

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in Google Chrome's DevTools allows unauthenticated attackers who convince users to install a malicious extension to bypass enterprise host restrictions and modify cookies, affecting Chrome versions prior to 147.0.7727.55. The vulnerability requires user interaction to install the malicious extension but grants attackers the ability to circumvent security policies protecting sensitive cookie data. With an EPSS score of 0.01% and Chromium severity rated as Low, real-world exploitation is unlikely despite the moderate CVSS score of 6.5.

Technical ContextAI

The vulnerability stems from insufficient input validation and policy enforcement in Chrome's DevTools feature when processing crafted Chrome Extensions (CWE-602: Authentication Bypass by Capture-replay). DevTools provides debugging capabilities for web developers, but the policy controls that should restrict extension-based modifications to cookies in enterprise environments were not properly enforced. Enterprise deployments use host policies to control which hosts extensions can access and which resources (including cookies) they can modify. The vulnerability allows a malicious extension to bypass these host restrictions through crafted payloads, compromising the integrity of the extension security model. Chrome Extensions are installed in the user's browser profile and execute with the permissions declared in their manifest, but this vulnerability allows circumventing additional enterprise policy controls that should supersede default extension permissions.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. Users can trigger updates manually by clicking the menu icon (three vertical dots) in the top-right corner, selecting 'Help', then 'About Google Chrome', which will automatically download and install the latest version. Enterprise administrators should deploy this update through their mobile device management (MDM) or configuration management systems. No workarounds are available other than updating; however, restricting extension installation via enterprise policies (Admin Console for workspace accounts) can reduce risk during gradual rollouts. Detailed patch information and stable channel updates are available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/479673903.