What is the CVSS score of EUVD-2026-20709?

EUVD-2026-20709 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20709?

Yes, a patch is available for EUVD-2026-20709. Update the affected software to the latest version immediately.

Google EUVD-2026-20709

| CVE-2026-5891 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

4.1 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:45 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20709

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome prior to version 147.0.7727.55 allows remote attackers with a compromised renderer process to deceive users through crafted HTML pages. The vulnerability requires prior renderer compromise, limiting real-world exploitation to scenarios where an attacker has already achieved code execution within the browser's sandboxed rendering context. No active exploitation confirmed; EPSS score of 0.03% indicates minimal exploitation probability.

Technical ContextAI

Chrome's renderer process operates in a sandbox that restricts access to sensitive browser UI elements and system resources. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) describes the root cause: insufficient enforcement of policy boundaries that prevent renderer-process code from manipulating or spoofing browser UI elements. An attacker who has already compromised the renderer through another vulnerability (such as a memory corruption flaw) can leverage this policy gap to render deceptive UI overlays or false interface elements that misrepresent critical security indicators, such as address bar content, HTTPS indicators, or certificate warnings.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. The vendor-released patch is available through Chrome's auto-update mechanism or manual download from google.com/chrome. Users can verify their current version via Chrome Menu > Help > About Google Chrome, which will automatically download and install the latest version if not current. No workarounds mitigate the vulnerability short of disabling JavaScript or avoiding untrusted websites; patching is the only reliable remediation. For enterprise deployments, administrators should use Chrome OS management console or Windows/Mac group policies to enforce rapid rollout of version 147.0.7727.55 or newer. Reference: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html