What is the CVSS score of CVE-2026-5919?

CVE-2026-5919 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5919?

Yes, a patch is available for CVE-2026-5919. Update the affected software to the latest version immediately.

Chrome CVE-2026-5919

EUVD-2026-20754 MEDIUM

Improper Input Validation (CWE-20)

2026-04-08 Chrome

GHSA-vv23-jmr5-38v3

Google Authentication Bypass Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.7 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20754

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Google Chrome prior to 147.0.7727.55 contains insufficient validation of untrusted input in WebSockets that allows a remote attacker with a compromised renderer process to bypass same-origin policy via a crafted HTML page. This vulnerability requires prior renderer compromise and user interaction, limiting real-world exploitability despite the high CVSS score. EPSS scoring (0.02%, 6th percentile) and Chromium's own Low severity classification indicate minimal practical risk despite the integrity impact rating.

Technical ContextAI

The vulnerability stems from improper validation (CWE-20) in Chrome's WebSocket implementation, a protocol that enables bidirectional communication over a single TCP connection. WebSockets are fundamental to modern web applications for real-time features. The affected component sits within the Chromium renderer process, which executes untrusted web content. The same-origin policy (SOP) is a critical browser security boundary preventing scripts from one origin from accessing resources of another. This flaw allows circumvention of that policy in a compromised renderer context. The attack vector (AV:N) indicates network-accessible exploitation, but the requirement for prior renderer compromise (noted in description) and user interaction (UI:R) substantially restricts the practical attack surface. CPE cpe:2.3:a:google:chrome indicates all Chrome versions prior to the patch are nominally affected.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 and later. Users should update to this version or newer immediately via the built-in auto-update mechanism (Chrome → About Chrome → automatic update check) or manually download from https://www.google.com/chrome/update. Organizations using Chrome Enterprise can deploy the update via managed deployment tools using the version number 147.0.7727.55 as the target. No workarounds exist for users who cannot immediately upgrade; the vulnerability requires both renderer compromise and user interaction with malicious HTML, so users should exercise caution with untrusted websites and browser extensions. Detailed patch information and additional context are available in the Chromium issue tracker at https://issues.chromium.org/issues/483423893 and Google's Chrome Releases blog at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.