This vulnerability (CVE-2026-5894) affects Google Chrome's PDF handling prior to version 147.0.7727.55. It involves an inappropriate implementation that permits a remote attacker to bypass navigation restrictions by leveraging a crafted HTML page. The issue is classified under CWE-358 (Improperly Restricting Operations within the Bounds of a Memory Buffer). The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. The vendor advisory linked does not explicitly state whether a fix is included in version 147.0.7727.55 or later.

The vulnerability allows bypassing navigation restrictions, which may lead to limited integrity impacts such as unauthorized navigation or redirection within the browser context. There is no impact on confidentiality or availability. No known exploits are reported in the wild, indicating limited current risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 147.0.7727.55, upgrading to this version or later is recommended if confirmed as patched. No additional mitigation guidance is provided by the vendor advisory.