CVE Catalog
CVE-2026-5896
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
Google Chrome prior to 147.0.7727.55 has a policy bypass in Audio, allowing a remote attacker who convinced a user to perform specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Severity: Low)
Risk Assessment
Risk of sandbox bypass, potentially leading to unauthorized file downloads or code execution.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later.
Original NVD description (English source)
Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Chromium security severity: Low)