What is the CVSS score of EUVD-2026-20730?

EUVD-2026-20730 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20730?

Yes, a patch is available for EUVD-2026-20730. Update the affected software to the latest version immediately.

Chrome EUVD-2026-20730

| CVE-2026-5905 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-04-08 Chrome

GHSA-4hgw-f49w-4349

Google Information Disclosure Microsoft Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20730

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing via incorrect security UI in Google Chrome on Windows prior to version 147.0.7727.55 allows unauthenticated remote attackers to deceive users through crafted HTML pages that exploit flawed permission display mechanisms. The attack requires user interaction (clicking or viewing a malicious page) but carries moderate real-world risk due to low EPSS exploitation probability (0.03%, 7th percentile) despite the high CVSS impact score, suggesting the vulnerability requires specific user actions or conditions to successfully exploit.

Technical ContextAI

This vulnerability resides in Chrome's permissions UI rendering layer on Windows, specifically in how the browser displays security indicators for permission requests. CWE-451 (User Interface (UI) Misrepresentation of Critical Information) indicates the root cause is improper visual representation of security-relevant data-in this case, domain identity in permission prompts. The flaw allows attackers to craft HTML pages that trigger permission dialogs where the displayed domain does not accurately reflect the actual requesting origin, enabling social engineering attacks that trick users into granting permissions to malicious sites believing they are legitimate. The vulnerability affects all Chrome versions on Windows below 147.0.7727.55 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55 or later. Users should navigate to Chrome menu > About Chrome to trigger automatic update download and installation; the browser will prompt for restart once patched. No workarounds are documented; however, users can temporarily reduce risk by avoiding clicking permission prompts on untrusted websites and reviewing the displayed domain carefully before granting permissions. Administrators managing Chrome deployments should update via their standard Chrome deployment tools or ensure auto-update is enabled. Official advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html; technical details: https://issues.chromium.org/issues/483899628.