What is the CVSS score of CVE-2026-5905?

CVE-2026-5905 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5905?

Yes, a patch is available for CVE-2026-5905. Update the affected software to the latest version immediately.

Google CVE-2026-5905

EUVD-2026-20730 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-4hgw-f49w-4349

Information Disclosure Google Microsoft

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20730

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing via incorrect security UI in Google Chrome on Windows prior to version 147.0.7727.55 allows unauthenticated remote attackers to deceive users through crafted HTML pages that exploit flawed permission display mechanisms. The attack requires user interaction (clicking or viewing a malicious page) but carries moderate real-world risk due to low EPSS exploitation probability (0.03%, 7th percentile) despite the high CVSS impact score, suggesting the vulnerability requires specific user actions or conditions to successfully exploit.

Technical ContextAI

This vulnerability resides in Chrome's permissions UI rendering layer on Windows, specifically in how the browser displays security indicators for permission requests. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) indicates the root cause is improper visual representation of security-relevant data-in this case, domain identity in permission prompts. The flaw allows attackers to craft HTML pages that trigger permission dialogs where the displayed domain does not accurately reflect the actual requesting origin, enabling social engineering attacks that trick users into granting permissions to malicious sites believing they are legitimate. The vulnerability affects all Chrome versions on Windows below 147.0.7727.55 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 or later. Users should navigate to Chrome menu > About Chrome to trigger automatic update download and installation; the browser will prompt for restart once patched. No workarounds are documented; however, users can temporarily reduce risk by avoiding clicking permission prompts on untrusted websites and reviewing the displayed domain carefully before granting permissions. Administrators managing Chrome deployments should update via their standard Chrome deployment tools or ensure auto-update is enabled. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html; technical details: https://issues.chromium.org/issues/483899628.