CVE-2026-5901 Google CVE debrief

Who should care

Enterprises using Google Chrome, particularly those with custom extensions or enterprise host restrictions, should prioritize patching to prevent potential cookie modification attacks. Security teams should review the vulnerability's impact on their specific environment and enforce strict policies for extension installation and usage.

Technical summary

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. The Chromium security severity is rated as Low. This issue affects Google Chrome's DevTools, specifically the policy enforcement mechanism. Enterprises should assess their exposure to this vulnerability, particularly if they use custom extensions or have enterprise host restrictions in place. The vulnerability was patched in Chrome version 147.0.7727.55. Security teams should review the vulnerability's impact on their specific environment and enforce strict policies for extension installation and usage to prevent potential cookie modification attacks.

Defensive priority

Medium priority due to potential for cookie modification attacks, but severity is rated as Low.

Recommended defensive actions

• Apply the patch by updating Google Chrome to version 147.0.7727.55 or later
• Review and restrict installation of custom extensions
• Monitor for suspicious cookie modification activity
• Enforce strict policies for extension installation and usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.983Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not reflect the full scope of affected systems. Defenders should verify the vulnerability's impact on their specific environment.

Official resources