PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5897 Google CVE debrief

CVE-2026-5897 is a MEDIUM severity vulnerability in Google Chrome prior to 147.0.7727.55, caused by incorrect security UI in Downloads. This allows a remote attacker who convinces a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. The vulnerability has a CVSS score of 4.3 and a Chromium security severity of Low. Users of Google Chrome prior to version 147.0.7727.55 should update to the latest version to prevent potential UI spoofing attacks. The vulnerability requires user interaction and is not a straightforward exploit.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should update to the latest version to prevent potential UI spoofing attacks. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and review their Chrome deployments to ensure they are up-to-date.

Technical summary

The vulnerability is caused by incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55. A remote attacker can convince a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. The Chromium security severity is Low, with a CVSS score of 4.3. The vulnerability affects Google Chrome's Downloads feature, which is used by users to manage their downloaded files.

Defensive priority

Medium priority, as the vulnerability requires user interaction and is not a straightforward exploit.

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later
  • Be cautious when engaging with HTML pages from unknown sources
  • Monitor for any suspicious activity in Google Chrome
  • Review Chrome's update history
  • Verify UI spoofing risks in Chrome's Downloads feature
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.597Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. The vulnerability is caused by incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55. Evidence limits suggest that defenders verify UI spoofing risks in Chrome's Downloads feature. Defensive verification tasks include reviewing Chrome's update history and monitoring for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5897 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5897

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5897 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5897

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.