What is the CVSS score of CVE-2026-5911?

CVE-2026-5911 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5911?

Yes, a patch is available for CVE-2026-5911. Update the affected software to the latest version immediately.

Google CVE-2026-5911

EUVD-2026-20742 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-08 Chrome

GHSA-vmw5-396h-99jh

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.1 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20742

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 4.3

DescriptionCVE.org

Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content security policy bypass in Google Chrome prior to version 147.0.7727.55 allows remote attackers to bypass CSP protections via ServiceWorker policy manipulation when users interact with crafted HTML pages. The vulnerability requires user interaction (UI:R in CVSS) and results in integrity impact only; EPSS exploitation probability is minimal at 0.02%, and Chromium rates the security severity as low despite the policy bypass nature.

Technical ContextAI

ServiceWorkers are background processes that intercept network requests and can cache content, playing a critical role in enforcing content security policies. CWE-693 (Protection Mechanism Failure) indicates the vulnerability stems from improper validation or enforcement of CSP headers at the ServiceWorker layer in Chromium's rendering engine. The flaw allows crafted HTML to manipulate how ServiceWorkers process or respect CSP directives, potentially leading to unauthorized script execution or content injection that would normally be blocked by CSP. The affected product is Google Chrome across all platforms (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 and later. Users should update to Chrome 147.0.7727.55 or any subsequent stable release. Chrome typically auto-updates on most platforms; verify update status via Chrome Menu > About Google Chrome, which will trigger an immediate check. No interim workarounds are documented; the patch is the primary remediation. For more details, consult the official Chrome security update advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html or the Chromium issue tracker at https://issues.chromium.org/issues/485785246.