What is the CVSS score of EUVD-2026-20684?

EUVD-2026-20684 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20684?

Yes, a patch is available for EUVD-2026-20684. Update the affected software to the latest version immediately.

Google EUVD-2026-20684

| CVE-2026-5878 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-gfjm-pp2m-j8cw

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:44 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20684

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via incorrect security UI rendering in Google Chrome's Blink engine allows remote attackers to deceive users into trusting malicious content through crafted HTML pages, affecting Chrome versions prior to 147.0.7727.55. The attack requires user interaction (clicking or viewing the malicious page) but no authentication. While assigned Medium severity by Google and carrying low EPSS exploitation probability (0.03%, 10th percentile), the integrity impact centers on user trust and phishing enablement rather than code execution.

Technical ContextAI

This vulnerability resides in Blink, Chrome's rendering engine, specifically in the security user interface (UI) layer that displays trust indicators, certificate warnings, address bar security signals, and other visual elements intended to protect users from malicious content. The flaw (CWE-451: User Interface (UI) Misrepresentation of Critical Information) allows crafted HTML to manipulate or spoof these UI elements, enabling attackers to create fake permission dialogs, false security badges, or misleading address bar indicators. The affected CPE range (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) indicates all Chrome versions prior to the patch are vulnerable, with the specific affected boundary at version 147.0.7727.55.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately through Chrome's automatic update mechanism (Settings > About Chrome) or manual download from google.com/chrome. Most users receive this patch automatically within hours of release; Enterprise deployments should verify version compliance through Chrome Enterprise management console. No workarounds exist short of disabling user-facing web content, as the vulnerability is inherent to the rendering engine's UI layer. For Chromium-based browsers, check vendor release notes for corresponding patched versions. Confirm remediation by navigating to chrome://version/ and verifying the version number is 147.0.7727.55 or higher.