What is the CVSS score of EUVD-2026-20715?

EUVD-2026-20715 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20715?

Yes, a patch is available for EUVD-2026-20715. Update the affected software to the latest version immediately.

Google EUVD-2026-20715

| CVE-2026-5894 MEDIUM

Improperly Implemented Security Check for Standard (CWE-358)

2026-04-08 Chrome

GHSA-w92q-q263-3p4v

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:26 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

4.3 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20715

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Google Chrome prior to version 147.0.7727.55 contains an inappropriate PDF implementation that allows remote attackers to bypass navigation restrictions via a crafted HTML page. The vulnerability requires user interaction to trigger and offers low real-world risk, with an EPSS score of 0.02% (3rd percentile) indicating minimal exploitation probability despite its network-accessible attack vector. A vendor-released patch is available.

Technical ContextAI

The vulnerability resides in Google Chrome's PDF handling implementation (CWE-358: Inappropriate Implementation), where navigation restriction controls are insufficiently enforced when processing specially crafted HTML pages that interact with PDF content. The affected component is part of Chrome's core PDF rendering engine. The vulnerability is specific to the PDF-in-Chrome feature and does not affect the underlying PDF specification itself, but rather how Chrome applies navigation policies to PDF documents loaded from or referenced by web pages. The issue allows circumvention of intended security boundaries that prevent PDF documents from performing certain navigation actions.

RemediationAI

Vendor-released patch: Update Google Chrome to version 147.0.7727.55 or later. Most users will receive this update automatically through Chrome's built-in auto-update mechanism; no manual intervention is typically required. Verify the installed version via Chrome menu (three dots) → Help → About Google Chrome, which will display the current version and trigger any pending updates. Organizations managing Chrome enterprise deployments should consult Google's official advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for deployment guidance. No workarounds are documented for versions prior to the patch.