{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5880", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-04-08T19:34:37.513Z", "datePublished": "2026-04-08T21:20:49.126Z", "dateUpdated": "2026-04-08T21:20:49.126Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "147.0.7727.55", "status": "affected", "lessThan": "147.0.7727.55", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect security UI"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-04-08T21:20:49.126Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"url": "https://issues.chromium.org/issues/424995036"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)"}], "id": "CVE-2026-5880", "lastModified": "2026-04-08T22:16:27.650", "metrics": {}, "published": "2026-04-08T22:16:27.650", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/424995036"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,147.0.7727.55)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-08T23:12:47.400221+00:00", "value": {"mitigation_remediation": ["Upgrade Chrome to version 147.0.7727.55 or later", "Ensure automatic updates for the stable channel are enabled", "Verify that the Omnibox displays the correct URL for trusted sites"], "summary": {"action": "Immediate Patch", "impact": "Omnibox content spoofing for phishing"}, "threat_synthesis": {"affected_systems": "All machines running the stable channel of Google Chrome with a version earlier than 147.0.7727.55 are affected. The weakness does not depend on operating system, extensions, or user settings; any installation of Chrome that allows the renderer process to be hijacked can be used to deliver the malicious page.", "description_and_impact": "A flaw in Google Chrome prevents sufficient policy enforcement in the browser UI, enabling a remote attacker who has already compromised the renderer process to serve a crafted HTML page that can overwrite the displayed address in the Omnibox. The effect is that users see a forged URL that does not match the actual site they are interacting with, which can be leveraged for phishing or social engineering. The vulnerability carries a Medium severity assigned by Chromium security, indicative of the potential for user deception but not of direct system compromise.", "risk_and_exploitability": "The flaw has a Medium CVSS score and no EPSS data is available, suggesting no evidence of widespread exploitation yet. Because the attacker must first achieve renderer\u2011process compromise\u2014typically via a separate vulnerability or malicious content delivery\u2014an adversary would need to bypass one protective layer first. Once that is achieved, the Omnibox can be spoofed to mislead the user, but this does not grant direct payload execution or system access. The risk is therefore limited to user deception unless combined with other exploits."}}}}, "created": "2026-04-09T08:17:22.570776+00:00", "title": "Chrome Omnibox Spoofing via Compromised Renderer", "updated": "2026-04-09T08:26:46.044217+00:00", "vendors": ["google", "google$PRODUCT$chrome"], "weaknesses": ["CWE-200", "CWE-79"]}