CVE Catalog
CVE-2026-5880
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
Google Chrome prior to 147.0.7727.55 has insufficient policy enforcement in browser UI, allowing an attacker with compromised renderer to spoof the Omnibox via crafted HTML.
Risk Assessment
Risk of user being tricked into believing they are on a trusted site, leading to data theft.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later.
Original NVD description (English source)
Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)