CVE-2026-5898 Google CVE debrief

Who should care

Users of Google Chrome on iOS, particularly those who browse the web on their iOS devices, should be aware of this vulnerability and ensure they are running version 147.0.7727.55 or later. IT administrators and security teams responsible for managing Google Chrome deployments on iOS devices should prioritize patching this vulnerability. Additionally, security teams should review compensating controls for exposed systems and monitor for suspicious activity.

Technical summary

The vulnerability is caused by incorrect security UI in the Omnibox of Google Chrome on iOS. This allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability has a CVSS score of 4.3 and a severity of Medium. The affected product is Google Chrome on iOS prior to version 147.0.7727.55. The vulnerability can be exploited by a remote attacker who can craft a malicious HTML page to perform UI spoofing attacks. Defenders should focus on patching the vulnerability and monitoring for suspicious activity.

Defensive priority

Medium priority should be given to patching this vulnerability, as it could allow attackers to perform UI spoofing attacks on users of Google Chrome on iOS.

Recommended defensive actions

• Apply the patch: Ensure Google Chrome on iOS is updated to version 147.0.7727.55 or later.
• Monitor for suspicious activity: Keep an eye on browser behavior and report any suspicious activity.
• Use secure browsing practices: Be cautious when clicking on links or providing sensitive information while browsing the web.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its severity, CVSS score, and affected versions of Google Chrome on iOS. However, the details are limited, and defenders should verify the affected scope and severity with the official advisory. The vulnerability has a CVSS score of 4.3 and a severity of Medium. Users should ensure they are running version 147.0.7727.55 or later. The CVE record was published on 2026-04-08T22:16:29.690Z and has not been modified since then. Evidence from the CVE record and NVD detail suggests that the vulnerability is caused by incorrect security UI in the Omnibox of Google Chrome on iOS.

Official resources