CVE-2026-5899 Google CVE debrief

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should apply the update to prevent potential UXSS attacks. This includes administrators and users of Google Chrome in managed environments, who should ensure all users are updated to the latest version. Additionally, security teams should monitor for any suspicious UI interactions that could be indicative of exploitation attempts.

Technical summary

The vulnerability, described as UXSS (User Interaction-based Security Vulnerabilities), allows a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page when a user engages in specific UI gestures. This can occur in Google Chrome prior to version 147.0.7727.55 due to insufficient policy enforcement in History Navigation. The vulnerability has a CVSS score of 6.1 and is classified as Medium severity.

Defensive priority

Medium

Recommended defensive actions

• Apply the Google Chrome update to version 147.0.7727.55 or later
• Ensure all users of Google Chrome are updated to the latest version
• Monitor for any suspicious UI interactions that could be indicative of exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.787Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. This vulnerability affects Google Chrome prior to version 147.0.7727.55. Users should verify their versions and update if necessary. The CVE record provides official details, and the NVD entry offers additional analysis.

Official resources