CVE Catalog
CVE-2026-5911
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.17%
6th percentile - higher than 6% of all known CVEs
Summary
Google Chrome prior to version 147.0.7727.55 contains a policy bypass vulnerability in ServiceWorkers that allows a remote attacker to bypass Content Security Policy via a crafted HTML page. (Severity: Low)
Risk Assessment
An attacker can bypass CSP, potentially allowing unauthorized script execution in the browser context, which could lead to data theft.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later, which includes the fix.
Original NVD description (English source)
Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)