What is the CVSS score of CVE-2026-5903?

CVE-2026-5903 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5903?

Yes, a patch is available for CVE-2026-5903. Update the affected software to the latest version immediately.

Google CVE-2026-5903

EUVD-2026-20727 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-08 Chrome

GHSA-c9xc-4327-hw8j

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.1 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

6.5 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20727

CVE Published

Apr 08, 2026 - 21:21 nvd

N/A

DescriptionCVE.org

Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Bypass of iframe sandbox navigation restrictions in Google Chrome prior to version 147.0.7727.55 allows remote attackers to circumvent security boundaries via a crafted HTML page combined with specific user UI gestures. The vulnerability affects the IFrameSandbox security mechanism, which is designed to prevent iframes from navigating the top-level window; successful exploitation requires user interaction but results in direct integrity impact through unauthorized navigation. This is a low-severity issue with minimal exploitation probability (EPSS 0.02%, percentile 3%) and no confirmed active exploitation.

Technical ContextAI

The IFrameSandbox feature in Chromium implements sandbox restrictions on iframe elements to enforce the Same-Origin Policy and prevent malicious frames from accessing or manipulating the parent window's navigation. The vulnerability exists in the sandbox policy enforcement logic (CWE-693: Protection Mechanism Failure), where insufficient validation of navigation restrictions allows a crafted HTML page to bypass these controls. The attack leverages a gap in how Chrome validates iframe-to-parent navigation transitions when specific user gestures are involved, essentially defeating the intended isolation boundary that sandboxed iframes are meant to provide.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately via the browser's built-in auto-update mechanism or manual download from https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. The vendor-released patch directly addresses the sandbox navigation enforcement logic and is the only effective mitigation. Organizations using Chromium-based browsers should verify that auto-updates are enabled and confirm the installed version exceeds 147.0.7727.55 to ensure the sandbox policy bypass is resolved.