PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5919 Google CVE debrief

CVE-2026-5919 is a vulnerability in Google Chrome prior to version 147.0.7727.55, caused by insufficient validation of untrusted input in WebSockets. This allows a remote attacker who has compromised the renderer process to bypass same origin policy via a crafted HTML page. The Chromium security severity is rated as Low, with a CVSS score of 6.5 and a MEDIUM severity rating. The vulnerability affects users of Google Chrome prior to version 147.0.7727.55 and has been addressed in the latest version of Chrome.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should update to the latest version to mitigate this vulnerability. Additionally, administrators and security teams responsible for managing Chrome deployments should prioritize updating Chrome to the latest version and consider implementing compensating controls such as monitoring for suspicious WebSocket activity.

Technical summary

The vulnerability exists in the WebSockets component of Google Chrome. An attacker who has compromised the renderer process can exploit this vulnerability to bypass same origin policy via a specially crafted HTML page. The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This issue is rated as Low severity by Chromium, with a CVSS score of 6.5 and a MEDIUM severity rating. The vulnerability was addressed in Google Chrome version 147.0.7727.55.

Defensive priority

Medium priority should be given to updating Google Chrome to version 147.0.7727.55 or later. Additionally, consider implementing compensating controls such as monitoring for suspicious WebSocket activity and reviewing same origin policy restrictions.

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later
  • Monitor for suspicious WebSocket activity
  • Implement same origin policy restrictions
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T22:16:31.667Z and has not been modified since then. The NVD entry was last modified on 2026-07-24T08:10:00.150Z. The vulnerability has a CVSS score of 6.5 and a MEDIUM severity rating. The Chromium security severity is rated as Low. The CVE record and NVD entry provide details on the vulnerability, but additional verification is recommended to ensure accurate understanding of the affected systems and potential impact.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T22:16:31.667Z and has not been modified since then.