CVE-2026-5897 Google CVE debrief

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should update to the latest version to prevent potential UI spoofing attacks. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and review their Chrome deployments to ensure they are up-to-date.

Technical summary

The vulnerability is caused by incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55. A remote attacker can convince a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. The Chromium security severity is Low, with a CVSS score of 4.3. The vulnerability affects Google Chrome's Downloads feature, which is used by users to manage their downloaded files.

Defensive priority

Medium priority, as the vulnerability requires user interaction and is not a straightforward exploit.

Recommended defensive actions

• Update Google Chrome to version 147.0.7727.55 or later
• Be cautious when engaging with HTML pages from unknown sources
• Monitor for any suspicious activity in Google Chrome
• Review Chrome's update history
• Verify UI spoofing risks in Chrome's Downloads feature
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.597Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. The vulnerability is caused by incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55. Evidence limits suggest that defenders verify UI spoofing risks in Chrome's Downloads feature. Defensive verification tasks include reviewing Chrome's update history and monitoring for suspicious activity.

Official resources