CVE-2026-5919: Insufficient validation of untrusted input in Google Chrome
CVE-2026-5919 is a vulnerability in Google Chrome prior to version 147. 0. 7727. 55 involving insufficient validation of untrusted input in WebSockets. This flaw could allow a remote attacker who has already compromised the renderer process to bypass the same origin policy using a crafted HTML page. The Chromium project has rated this security issue as low severity. There is no CVSS score provided, and no known exploits in the wild have been reported. The vulnerability affects Chrome desktop versions before 147. 0. 7727.
AI Analysis
Technical Summary
This vulnerability arises from insufficient validation of untrusted input in the WebSockets implementation of Google Chrome before version 147.0.7727.55. An attacker with control over the renderer process could exploit this to bypass the same origin policy, potentially enabling unauthorized access to web resources. The issue is classified as low severity by the Chromium security team. The vendor has released an update in Chrome version 147.0.7727.55 to fix this vulnerability.
Potential Impact
The impact is limited to scenarios where an attacker has already compromised the renderer process, enabling them to bypass the same origin policy via crafted HTML content. This could lead to unauthorized access to web resources within the browser context. No known exploits are reported in the wild, and the severity is considered low by the vendor.
Mitigation Recommendations
A fixed version of Google Chrome (147.0.7727.55) has been released that addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is a client-side vulnerability in a desktop browser, applying the official update is the recommended mitigation. No additional vendor-recommended mitigations are indicated.
CVE-2026-5919: Insufficient validation of untrusted input in Google Chrome
Description
CVE-2026-5919 is a vulnerability in Google Chrome prior to version 147. 0. 7727. 55 involving insufficient validation of untrusted input in WebSockets. This flaw could allow a remote attacker who has already compromised the renderer process to bypass the same origin policy using a crafted HTML page. The Chromium project has rated this security issue as low severity. There is no CVSS score provided, and no known exploits in the wild have been reported. The vulnerability affects Chrome desktop versions before 147. 0. 7727.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from insufficient validation of untrusted input in the WebSockets implementation of Google Chrome before version 147.0.7727.55. An attacker with control over the renderer process could exploit this to bypass the same origin policy, potentially enabling unauthorized access to web resources. The issue is classified as low severity by the Chromium security team. The vendor has released an update in Chrome version 147.0.7727.55 to fix this vulnerability.
Potential Impact
The impact is limited to scenarios where an attacker has already compromised the renderer process, enabling them to bypass the same origin policy via crafted HTML content. This could lead to unauthorized access to web resources within the browser context. No known exploits are reported in the wild, and the severity is considered low by the vendor.
Mitigation Recommendations
A fixed version of Google Chrome (147.0.7727.55) has been released that addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is a client-side vulnerability in a desktop browser, applying the official update is the recommended mitigation. No additional vendor-recommended mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-04-08T20:10:22.501Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html","vendor":"Google"}]
Threat ID: 69d6ca441cc7ad14dab3ce63
Added to database: 4/8/2026, 9:36:04 PM
Last enriched: 4/8/2026, 9:50:44 PM
Last updated: 4/8/2026, 11:22:30 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.