CVE-2026-5897

CVE-2026-5897 is a UI spoofing vulnerability in Google Chrome versions prior to 147.0.7727.55 that affects the Downloads security interface. An attacker could exploit this flaw by convincing a user to perform specific UI gestures on a crafted HTML page, potentially misleading the user about the legitimacy or origin of downloaded content. This vulnerability demonstrates a security weakness in how Chrome displays download-related dialogs and warnings. The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring no privileges but necessitating user interaction. The impact is limited to integrity concerns with no confidentiality or availability effects. Chrome's internal severity assessment classified this as Low, reflecting the restricted attack surface and dependence on user engagement with specific UI elements. Exploitation remains minimal, with no evidence of active exploitation in the wild or public availability of working exploit code. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and community attention is relatively low as indicated by its inactive status on threat tracking platforms. Organizations should apply Chrome version 147.0.7727.55 or later as part of standard patching procedures, though the low exploitation probability suggests this is not a critical remediation priority.