CVE-2026-5906 Google CVE debrief

Who should care

Users of Google Chrome on Android prior to version 147.0.7727.55 should update to the latest version to prevent potential spoofing attacks. This vulnerability requires user interaction to exploit and has a moderate impact on affected systems. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators of affected systems should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by incorrect security UI in the Omnibox of Google Chrome on Android. This allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. It requires user interaction to exploit and has a moderate impact on affected systems. The vulnerability affects Google Chrome on Android prior to version 147.0.7727.55.

Defensive priority

Medium priority, as it requires user interaction to exploit and has a moderate impact on affected systems. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Recommended defensive actions

• Update Google Chrome on Android to version 147.0.7727.55 or later
• Be cautious when clicking on links or entering URLs in the Omnibox
• Verify the authenticity of websites before entering sensitive information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T22:16:30.490Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. The vulnerability affects Google Chrome on Android prior to version 147.0.7727.55. Users should verify the authenticity of websites before entering sensitive information and be cautious when clicking on links or entering URLs in the Omnibox. The CVE record was obtained from the official CVE website and the NVD database.

Official resources