PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5899 Google CVE debrief

CVE-2026-5899 is a Medium severity vulnerability in Google Chrome prior to 147.0.7727.55. It is caused by insufficient policy enforcement in History Navigation, which allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page when a user engages in specific UI gestures. This vulnerability can lead to potential UXSS attacks if not addressed. Users of Google Chrome prior to version 147.0.7727.55 should apply the update to prevent such attacks.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should apply the update to prevent potential UXSS attacks. This includes administrators and users of Google Chrome in managed environments, who should ensure all users are updated to the latest version. Additionally, security teams should monitor for any suspicious UI interactions that could be indicative of exploitation attempts.

Technical summary

The vulnerability, described as UXSS (User Interaction-based Security Vulnerabilities), allows a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page when a user engages in specific UI gestures. This can occur in Google Chrome prior to version 147.0.7727.55 due to insufficient policy enforcement in History Navigation. The vulnerability has a CVSS score of 6.1 and is classified as Medium severity.

Defensive priority

Medium

Recommended defensive actions

  • Apply the Google Chrome update to version 147.0.7727.55 or later
  • Ensure all users of Google Chrome are updated to the latest version
  • Monitor for any suspicious UI interactions that could be indicative of exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.787Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. This vulnerability affects Google Chrome prior to version 147.0.7727.55. Users should verify their versions and update if necessary. The CVE record provides official details, and the NVD entry offers additional analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5899 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5899

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5899 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5899

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.