CVE-2026-5889 describes a cryptographic vulnerability in the PDFium component of Google Chrome before version 147.0.7727.55. The flaw enables an attacker to potentially extract sensitive data from encrypted PDF documents through brute-force methods. The vulnerability affects desktop versions of Chrome and was publicly disclosed on April 8, 2026. Google released an update to Chrome 147.0.7727.55 that addresses this issue. No CVSS score is available, and no exploits have been reported in the wild.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive information contained within encrypted PDF files viewed in vulnerable versions of Chrome. This could lead to information disclosure. However, the attack requires brute-force techniques, which may limit the practicality and speed of exploitation. There are no reports of active exploitation in the wild.

Users should update Google Chrome to version 147.0.7727.55 or later to remediate this vulnerability. The vendor advisory confirms that the issue is fixed in this version. No additional mitigation steps are indicated or required according to the vendor advisory.