CVE-2026-5905: Google Chrome XSS Vulnerability on Windows

CVE-2026-5905 Overview

CVE-2026-5905 is an incorrect security UI vulnerability in the Permissions component of Google Chrome on Windows. This flaw exists in versions prior to 147.0.7727.55 and allows a remote attacker to perform domain spoofing via a crafted HTML page. The vulnerability stems from improper handling of security indicators in the browser's permissions interface, potentially misleading users about the true origin of permission requests.

Critical Impact

Attackers can craft malicious HTML pages that spoof legitimate domains in Chrome's permission dialogs, potentially tricking users into granting sensitive permissions (camera, microphone, location, notifications) to malicious sites while believing they are interacting with trusted domains.

Affected Products

• Google Chrome on Windows prior to version 147.0.7727.55
• Chromium-based browsers on Windows using affected permission UI components

Discovery Timeline

• 2026-04-08 - CVE-2026-5905 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-5905

Vulnerability Analysis

This vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The flaw exists in how Google Chrome's Permissions component renders and displays security-critical information to users on Windows systems. When a malicious actor crafts a specially designed HTML page, the browser's permission dialog can be manipulated to display misleading domain information, causing users to believe they are granting permissions to a trusted website when they are actually authorizing a malicious domain.

The attack requires user interaction, as victims must visit a malicious page and interact with the spoofed permission dialog. However, once deceived, users may inadvertently grant sensitive browser permissions such as camera access, microphone access, geolocation, or push notifications to attacker-controlled sites.

Root Cause

The root cause of this vulnerability lies in the improper validation and rendering of domain information within Chrome's permission request UI on Windows. The Permissions component fails to adequately verify and display the true origin of permission requests, allowing attackers to inject or manipulate visual elements that represent the requesting domain. This UI misrepresentation vulnerability (CWE-451) enables sophisticated phishing attacks that bypass users' security awareness by exploiting trust in the browser's native permission dialogs.

Attack Vector

The attack is network-based and requires the victim to navigate to a malicious HTML page crafted by the attacker. The exploitation flow typically involves:

1. Attacker creates a malicious HTML page designed to trigger Chrome's permission dialog
2. The crafted page manipulates the UI to display a spoofed legitimate domain name
3. Victim visits the attacker's page through phishing links, malvertising, or compromised websites
4. Chrome displays a permission request that appears to originate from a trusted domain
5. Victim grants permission believing they are authorizing a legitimate site
6. Attacker gains access to sensitive browser capabilities under false pretenses

This vulnerability does not require authentication or special privileges to exploit, but does require user interaction (clicking to grant permission) for successful exploitation.

Detection Methods for CVE-2026-5905

Indicators of Compromise

• Unexpected permission grants appearing in Chrome's site settings for domains users don't recall visiting
• Browser permission prompts displaying unusual or slightly misspelled domain names
• Notifications, camera, or microphone access from unfamiliar origins
• Users reporting confusion about permission requests they believed they granted to legitimate sites

Detection Strategies

• Monitor Chrome browser versions across the enterprise to identify instances running versions below 147.0.7727.55
• Review browser permission logs and settings for anomalous permission grants
• Implement web filtering to detect and block known malicious domains exploiting this technique
• Deploy endpoint detection to alert on suspicious HTML content patterns associated with UI spoofing

Monitoring Recommendations

• Enable Chrome Enterprise reporting to track browser versions and security states
• Configure SentinelOne Singularity to monitor for browser-based anomalies and permission changes
• Audit enterprise browser configurations regularly for unexpected permission grants
• Establish baseline browser behavior profiles to identify deviations indicating compromise

How to Mitigate CVE-2026-5905

Immediate Actions Required

• Update Google Chrome on Windows to version 147.0.7727.55 or later immediately
• Verify all Chromium-based browsers in your environment are updated to patched versions
• Educate users about the risks of granting browser permissions and to verify domain names carefully
• Review and revoke suspicious permissions in Chrome settings across managed endpoints

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 147.0.7727.55. Organizations should prioritize deploying this update across all Windows endpoints running Google Chrome. For detailed information about the security update, refer to the Google Chrome Update Notice. Additional technical details are available via the Chromium Issue Tracker Entry.

Workarounds

• Configure Chrome Enterprise policies to restrict permission prompts or require administrator approval for sensitive permissions
• Implement web content filtering to block access to known malicious domains
• Use browser isolation technologies for high-risk browsing activities
• Consider temporarily disabling automatic permission prompts via Chrome policies until patching is complete

# Chrome Enterprise policy configuration example
# Set in Windows Registry or via Group Policy

# Restrict camera permission to specific domains only
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\VideoCaptureAllowedUrls" /v 1 /t REG_SZ /d "https://trusted-domain.com" /f

# Restrict microphone permission to specific domains only
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\AudioCaptureAllowedUrls" /v 1 /t REG_SZ /d "https://trusted-domain.com" /f

# Block all geolocation requests by default
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultGeolocationSetting /t REG_DWORD /d 2 /f