CVE-2026-5900: Google Chrome Policy Bypass Vulnerability

CVE-2026-5900 Overview

CVE-2026-5900 is a policy bypass vulnerability affecting the Downloads component in Google Chrome prior to version 147.0.7727.55. This security flaw allows a remote attacker to bypass multi-download protections through a specially crafted HTML page. The Chromium security team has classified this vulnerability as Low severity.

Critical Impact

Remote attackers can circumvent Chrome's multi-download security protections, potentially enabling unauthorized batch file downloads without user consent through malicious web pages.

Affected Products

• Google Chrome prior to version 147.0.7727.55
• Chromium-based browsers using vulnerable download protection code

Discovery Timeline

• 2026-04-08 - CVE-2026-5900 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-5900

Vulnerability Analysis

This vulnerability exists within Chrome's download protection mechanism, specifically affecting the multi-download safeguards designed to prevent malicious websites from initiating multiple simultaneous file downloads without explicit user consent. The policy bypass allows attackers to craft HTML pages that circumvent these protective controls, potentially enabling drive-by download scenarios.

Chrome implements download policies to protect users from websites attempting to automatically download multiple files, which could be used for malware distribution, disk space exhaustion, or overwhelming the user's download queue. This vulnerability undermines those protections by exploiting a flaw in how the browser validates and enforces download restrictions.

Root Cause

The root cause stems from improper policy enforcement in Chrome's Downloads component. The multi-download protection mechanism fails to adequately validate certain crafted HTML page constructs, allowing attackers to trigger multiple downloads that should otherwise be blocked by browser security policies.

Attack Vector

The attack requires user interaction in the form of visiting a malicious webpage. An attacker would need to host a specially crafted HTML page designed to exploit the policy bypass. When a victim navigates to this page, the attacker can initiate multiple file downloads that bypass Chrome's normal protective prompts and restrictions.

The exploitation mechanism involves crafting HTML content that exploits the validation gap in Chrome's download policy enforcement. Attackers could potentially chain this with social engineering tactics to distribute malicious payloads. For technical details on the specific implementation flaw, refer to Chromium Issue #475265304.

Detection Methods for CVE-2026-5900

Indicators of Compromise

• Unusual patterns of multiple simultaneous file downloads without user-initiated prompts
• Web pages triggering rapid sequential download requests from untrusted sources
• Browser logs showing bypassed download protection events

Detection Strategies

• Monitor browser telemetry for anomalous download patterns that circumvent normal user prompts
• Implement network-level detection for pages attempting to initiate multiple downloads in quick succession
• Review endpoint detection logs for unusual download activity from web browser processes
• Deploy web filtering rules to block known malicious pages exploiting this vulnerability

Monitoring Recommendations

• Enable verbose logging for Chrome download events in enterprise environments
• Monitor proxy logs for suspicious download request patterns from single web sessions
• Implement alerting for endpoints receiving multiple file downloads from untrusted domains
• Track Chrome version compliance across the organization to identify unpatched systems

How to Mitigate CVE-2026-5900

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later immediately
• Verify all Chromium-based browsers in your environment are updated to patched versions
• Review and strengthen web filtering policies to block suspicious download behavior
• Educate users about the risks of visiting untrusted websites

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 147.0.7727.55. The fix implements proper validation and enforcement of multi-download protection policies. Organizations should deploy this update across all managed endpoints immediately.

For detailed release notes, see the Google Chrome Desktop Update.

Workarounds

• Implement strict enterprise browser policies limiting download capabilities from untrusted sources
• Use web proxy solutions to inspect and filter potentially malicious HTML content
• Enable Chrome's Safe Browsing enhanced protection mode for additional security layers
• Consider network-level blocking of pages known to exploit this vulnerability until patching is complete

# Chrome Enterprise Policy Configuration
# Add to Chrome policy file to restrict downloads from untrusted sources
# Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
# macOS: /Library/Managed Preferences/com.google.Chrome.plist
# Linux: /etc/opt/chrome/policies/managed/

# Example JSON policy to restrict automatic downloads
{
  "AutomaticDownloadsAllowedForUrls": [],
  "AutomaticDownloadsBlockedForUrls": ["*"],
  "DownloadRestrictions": 1
}