CVE-2026-5901
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)
Risk Assessment
The risk is the possibility of bypassing enterprise security policies by a malicious extension, which can lead to unauthorized cookie modification and potentially session compromise.
Recommendation
It is recommended to update Google Chrome to version 147.0.7727.55 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)