This vulnerability (CVE-2026-5894) affects Google Chrome's PDF handling prior to version 147.0.7727.55. Due to an inappropriate implementation, a crafted HTML page can bypass navigation restrictions intended to limit user navigation within PDF content. The issue is classified under CWE-358 (Improperly Restricting Operations within the Bounds of a Memory Buffer or Data Structure). The CVSS v3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The impact is limited to integrity as the vulnerability allows bypassing navigation restrictions in PDF content within Chrome. There is no impact on confidentiality or availability. No known exploits are reported in the wild, reducing immediate risk. The issue could potentially be used to manipulate user navigation flows within PDF documents, but the overall risk is moderate given the CVSS score and lack of exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 147.0.7727.55, updating Chrome to version 147.0.7727.55 or later is recommended once confirmed by the vendor. No other specific mitigations are indicated by the vendor advisory.