What is the CVSS score of EUVD-2026-20681?

EUVD-2026-20681 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20681?

Yes, a patch is available for EUVD-2026-20681. Update the affected software to the latest version immediately.

Google EUVD-2026-20681

| CVE-2026-5875 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-08 Chrome

GHSA-32x4-hg4x-w43c

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20681

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:20 nvd

MEDIUM 4.3

DescriptionCVE.org

Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via policy bypass in Blink rendering engine in Google Chrome prior to version 147.0.7727.55 allows remote attackers to deceive users through crafted HTML pages. The vulnerability requires user interaction (clicking or viewing) but needs no authentication, affecting all Chrome users on unpatched versions. Chromium security team rated this as Medium severity; EPSS score of 0.02% indicates low real-world exploitation probability despite public disclosure.

Technical ContextAI

This vulnerability exists in Blink, Google Chrome's rendering engine, and relates to CWE-639 (Authorization Bypass Through User-Controlled Key), indicating improper enforcement of security policies during HTML rendering. The flaw allows attackers to bypass intended UI restrictions through crafted HTML content, enabling visual spoofing attacks where malicious pages can impersonate legitimate UI elements (such as address bars, security indicators, or dialogs) to deceive users into performing unintended actions. The attack surface is the HTML parser and rendering pipeline in Blink, which processes untrusted web content by default.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 and later. Users should update Chrome immediately via Settings > About Chrome, which typically triggers automatic update on launch. Organizations managing Chrome deployments should push version 147.0.7727.55 or higher to all endpoints. No workaround is available for unpatched versions; the vulnerability requires either browser upgrade or restriction of untrusted website access. Chromium-based browsers (Edge, Brave, etc.) derived from the same Blink engine should verify patch status in their respective release notes.