CVE-2026-5889 is a medium severity vulnerability in Google Chrome's PDFium library before version 147.0.7727.55. It involves a cryptographic weakness (CWE-326) that enables an attacker to perform brute-force attacks on encrypted PDFs, potentially exposing sensitive information. The vulnerability requires user interaction and network access but no privileges. The CVSS vector indicates low complexity and no privileges required, but user interaction is necessary. No official remediation level or patch link is explicitly provided in the data, though a vendor advisory URL is available.

The vulnerability allows an attacker to read potentially sensitive information from encrypted PDF documents by brute forcing the cryptographic protection. This compromises confidentiality of data contained within encrypted PDFs viewed in affected Chrome versions. There is no impact on integrity or availability. No known exploits have been reported in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 147.0.7727.55 or later once available. Until then, avoid opening untrusted encrypted PDFs in affected Chrome versions.