CVE-2026-5895

CVE-2026-5895 is an incorrect security UI vulnerability affecting Google Chrome on iOS versions prior to 147.0.7727.55, wherein a remote attacker could craft a malicious domain name to spoof the contents of the Omnibox (URL bar), potentially deceiving users about which website they are visiting. This vulnerability carries a CVSS score of 5.4 (MEDIUM severity) with a network-based attack vector requiring minimal complexity and user interaction, presenting a confidentiality and availability impact. The attack has a low Chromium security rating and is not currently listed on the CISA KEV catalog, indicating no evidence of active exploitation in the wild. With an EPSS score of 0.0007 and a FAUCET risk score of 32.0/100, this vulnerability poses a relatively low exploitation probability and community attention risk compared to the broader CVE landscape. Organizations should prioritize patching Chrome on iOS to version 147.0.7727.55 or later as part of routine updates, though immediate emergency remediation is not warranted given the inactive exploitation status and low attack complexity requirements.