CVE Catalog
CVE-2026-5919
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
Google Chrome prior to 147.0.7727.55 has insufficient validation in WebSockets, allowing an attacker with compromised renderer to bypass same-origin policy via crafted HTML.
Risk Assessment
Risk of cross-origin data theft or unauthorized actions in another domain context.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later.
Original NVD description (English source)
Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)