What is the CVSS score of EUVD-2026-20707?

EUVD-2026-20707 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20707?

Yes, a patch is available for EUVD-2026-20707. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-20707

| CVE-2026-5890 MEDIUM

Race Condition (CWE-362)

2026-04-08 Chrome

GHSA-2fw9-cxch-qx5h

Information Disclosure Google Race Condition

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Race condition demands precise timing (AC:H); victim must visit crafted page (UI:R); process memory leakage justifies C:H; no write or availability impact observed.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:10 vuln.today

CVSS changed

Apr 16, 2026 - 16:37 NVD

5.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20707

CVE Published

Apr 08, 2026 - 21:20 cve.org

MEDIUM 5.3

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionNVD

Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Race condition in Chrome's WebCodecs component allows a remote attacker to read sensitive data from process memory by luring a victim to a crafted HTML page. Affected versions are all Google Chrome releases prior to 147.0.7727.55. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), reflecting very low real-world exploitation probability despite the high confidentiality impact rating.

Technical ContextAI

WebCodecs is a low-level browser API introduced in Chrome 94 that exposes audio and video codec primitives directly to JavaScript, enabling high-performance media processing pipelines. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) indicates the WebCodecs implementation contains a race condition - likely a time-of-check/time-of-use (TOCTOU) flaw - where concurrent operations on a shared memory buffer or codec state object are not properly serialized. A crafted HTML page can manipulate codec operations to open a narrow window during which out-of-scope process memory becomes readable by the renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions below 147.0.7727.55.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later using Chrome's built-in updater (chrome://settings/help) or via enterprise deployment channels, as announced at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. For environments where immediate patching is not feasible, consider restricting navigation to untrusted or external websites via enterprise policy - note this has significant usability trade-offs. Chrome's Site Isolation feature (enabled by default) partially limits cross-site memory exposure but does not fully mitigate intra-process race conditions within the renderer. Disabling the WebCodecs API via enterprise policy (BlockThirdPartyCookies or renderer-side feature flags) may eliminate the attack surface but will break legitimate media-heavy web applications. Patch deployment is strongly preferred over compensating controls given the complexity of reliable exploitation.