PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5911 Apple CVE debrief

CVE-2026-5911 is a browser policy-bypass issue in Google Chrome ServiceWorkers. According to the official record, versions prior to 147.0.7727.55 could allow a remote attacker to bypass Content Security Policy by using a crafted HTML page. NVD rates the issue CVSS 3.1 4.3 (MEDIUM), with network attack vector, no privileges required, and user interaction required. Chromium’s own severity label is Low, but the finding is still relevant for environments that rely on CSP as part of their web defense model.

Vendor
Apple
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Security teams managing Chrome deployments, endpoint and browser administrators, and application owners who depend on Content Security Policy enforcement. Users and organizations running Chrome versions earlier than 147.0.7727.55 should prioritize remediation, especially where untrusted web content is regularly opened.

Technical summary

The record describes a policy-bypass weakness in Chrome ServiceWorkers that can be triggered remotely through a crafted HTML page. The effect is CSP bypass rather than full code execution, which aligns with the supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) and the CWE-693 mapping in NVD. The vulnerable product scope in the source corpus is Google Chrome versions before 147.0.7727.55.

Defensive priority

Medium

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later.
  • Verify that browser auto-update is functioning across managed and unmanaged endpoints.
  • Accelerate deployment through enterprise browser management or patching workflows where Chrome is centrally managed.
  • Review web applications that depend on CSP and validate behavior with the fixed Chrome version.
  • Track the linked Chrome release notes and NVD record for any follow-up changes or clarifications.

Evidence notes

Based only on the supplied official sources: the NVD record for CVE-2026-5911, the linked Chrome release notes, and the Chromium issue reference. The source corpus identifies Google Chrome versions prior to 147.0.7727.55 as vulnerable and describes the impact as a CSP bypass via a crafted HTML page. NVD shows publication on 2026-04-08 and a modified record on 2026-05-10. Note: the provided vendor metadata field says Apple, but the vulnerability evidence in the record is for Google Chrome; this debrief follows the source references and CPE criteria.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5911 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5911

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5911 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5911

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.