CVE-2026-5875

CVE-2026-5875 is a policy bypass vulnerability in the Blink rendering engine affecting Google Chrome versions prior to 147.0.7727.55. The flaw enables remote attackers to perform UI spoofing attacks through specially crafted HTML pages, potentially deceiving users into performing unintended actions. This vulnerability has been assigned a Medium severity classification by Chromium security review. The attack requires minimal technical complexity, as it can be executed over the network without elevated privileges and only necessitates user interaction with a malicious webpage. The CVSS 3.1 score of 4.3 reflects a limited impact scope, with potential integrity compromise but no confidentiality or availability impact. The relatively low CVSS score indicates this is a UI-focused deception attack rather than a critical system compromise vector. There is currently no evidence of active exploitation in the wild, with the EPSS score of 0.000250000 indicating minimal real-world exploitation probability. The vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on threat intelligence hot lists. Organizations should prioritize patching to Chrome 147.0.7727.55 or later as part of routine security updates, though this does not require emergency remediation protocols.