CVE Catalog
CVE-2026-5899
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.13%
3th percentile - higher than 3% of all known CVEs
Summary
Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Risk Assessment
An attacker can steal user credentials or sessions, leading to data confidentiality breaches in the organization.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later.
Original NVD description (English source)
Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)