What is the CVSS score of CVE-2026-5906?

CVE-2026-5906 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5906?

Yes, a patch is available for CVE-2026-5906. Update the affected software to the latest version immediately.

Chrome CVE-2026-5906

EUVD-2026-20732 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-g3cg-9h6m-vx92

Google Information Disclosure Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20732

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Omnibox spoofing in Google Chrome on Android prior to version 147.0.7727.55 allows remote attackers to deceive users by displaying falsified URL bar contents through a crafted HTML page, enabling phishing and social engineering attacks without requiring user interaction beyond visiting a malicious site. Despite a low CVSS score of 4.3 and minimal EPSS exploitation probability (0.03%), the vulnerability has real-world impact because attackers can trick users into believing they are on legitimate domains while actually on attacker-controlled pages.

Technical ContextAI

This vulnerability involves an incorrect security user interface (UI) implementation in Chrome's Omnibox (address bar) component on Android. The root cause is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating that the security-critical URL display mechanism fails to accurately represent the actual page context to the user. An attacker can craft malicious HTML content that exploits rendering or display logic flaws in the Omnibox to show a different URL than the one actually loaded, breaking the fundamental trust model users rely on to verify they are communicating with the intended website. This affects Google Chrome across all versions prior to 147.0.7727.55 on Android (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:android). The vulnerability is specific to Android's Chrome implementation, suggesting platform-specific UI rendering or WebView handling differences.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 or later. Android users should update Chrome immediately through the Google Play Store or enable automatic updates in Chrome settings. The Chrome Stable channel automatically rolls out updates; users can manually check for updates by opening Chrome, navigating to Settings > About Chrome, and allowing the update process to complete. No workarounds are available for older versions. See Google Chrome Releases blog post (http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html) and Chromium issue tracker (https://issues.chromium.org/issues/484082189) for official details.