What is the CVSS score of CVE-2026-5918?

CVE-2026-5918 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5918?

Yes, a patch is available for CVE-2026-5918. Update the affected software to the latest version immediately.

Google CVE-2026-5918

EUVD-2026-20752 MEDIUM

Origin Validation Error (CWE-346)

2026-04-08 Chrome

GHSA-26fq-x95v-v55j

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.9 LOW

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20752

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Google Chrome prior to version 147.0.7727.55 contains an information disclosure vulnerability in the Navigation component that allows a remote attacker with a compromised renderer process to leak cross-origin data via a crafted HTML page. The vulnerability requires user interaction and only affects confidentiality (CVSS 4.3), with an extremely low EPSS score of 0.03% indicating minimal real-world exploitation probability despite the unauthenticated attack vector.

Technical ContextAI

This vulnerability stems from CWE-346 (Origin Validation Error), a weakness in how browsers validate and enforce same-origin policy boundaries. The Navigation component in Chromium handles inter-frame communication and resource loading; inappropriate implementation in this component fails to properly isolate cross-origin data access. The renderer process is Chrome's sandboxed process responsible for executing untrusted web content; compromise of the renderer (via another vulnerability) combined with this Navigation flaw creates a secondary data leakage channel. The affected product is Google Chrome across all platforms (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), with the vulnerability present in all versions prior to 147.0.7727.55.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later. The patch is available via the stable channel update released by Google in April 2026, with automated updates available through Chrome's built-in update mechanism (check Chrome menu > Help > About Google Chrome). No workarounds are documented for this vulnerability; patching is the only remediation. Users should ensure automatic updates are enabled to receive the fix without manual intervention. Additional information is available at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/490139441.