CVE-2026-5903

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Google Chrome prior to version 147.0.7727.55 has a policy bypass vulnerability in IFrameSandbox. A remote attacker can convince a user to perform specific UI gestures to bypass navigation restrictions via a crafted HTML page.

Risk Assessment

An attacker can bypass browser security mechanisms, potentially enabling unauthorized navigation or access to sensitive content.

Recommendation

Update Google Chrome to version 147.0.7727.55 or later.

Original NVD description (English source)

Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)