CVE-2026-5919: Google Chrome Auth Bypass Vulnerability

CVE-2026-5919 Overview

CVE-2026-5919 is an input validation vulnerability in the WebSockets implementation of Google Chrome prior to version 147.0.7727.55. The flaw allows a remote attacker who has already compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Exploitation requires user interaction, typically by enticing the victim to visit attacker-controlled content. Chromium tracks the underlying defect as issue #483423893 and classifies the security severity as Low. Google has released a stable channel update to address the issue across Windows, macOS, and Linux desktop builds.

Critical Impact

An attacker with renderer-level access can violate web origin boundaries, exposing cross-origin data and undermining browser isolation guarantees.

Affected Products

• Google Chrome versions prior to 147.0.7727.55
• Chromium-based browser deployments on Microsoft Windows
• Chromium-based browser deployments on Apple macOS and Linux

Discovery Timeline

• 2026-04-08 - CVE-2026-5919 published to the National Vulnerability Database
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5919

Vulnerability Analysis

The vulnerability resides in Chrome's WebSockets component, which handles persistent bidirectional connections between web pages and remote servers. Chrome fails to sufficiently validate untrusted input flowing through this subsystem. As a result, an attacker who has already gained code execution inside the sandboxed renderer process can leverage crafted WebSocket interactions to break the same-origin policy. The same-origin policy is the browser's foundational isolation boundary, preventing a document loaded from one origin from reading data belonging to another. Bypassing it permits unauthorized access to authenticated content, cookies, and DOM state from cross-origin web applications. The defect is categorized under CWE-20: Improper Input Validation.

Root Cause

The root cause is missing or incomplete sanitization of attacker-controlled values processed by the WebSockets code path. Trusted assumptions about message framing or origin metadata are not enforced when the renderer is malicious. This allows the compromised renderer to inject data that downstream logic treats as authoritative.

Attack Vector

Exploitation is a two-stage chain. First, an attacker must compromise the renderer process, typically by chaining a prior renderer vulnerability. Second, the attacker delivers a crafted HTML page that the victim loads in the compromised tab. The HTML triggers the malformed WebSocket flow, producing the same-origin policy bypass. The attack is network-reachable and requires user interaction to load the malicious page.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker entry #483423893.

Detection Methods for CVE-2026-5919

Indicators of Compromise

• Chrome browser processes running versions earlier than 147.0.7727.55 after the patch availability window.
• Anomalous outbound WebSocket connections from renderer child processes to untrusted hosts.
• Browser telemetry showing unexpected cross-origin reads following navigation to untrusted pages.

Detection Strategies

• Inventory installed Chrome versions across managed endpoints and flag any build prior to 147.0.7727.55.
• Inspect proxy and DNS logs for connections to suspicious WebSocket endpoints (ws:// and wss://) initiated from user browsing sessions.
• Correlate browser crash reports and renderer compromise indicators with subsequent unusual web traffic patterns.

Monitoring Recommendations

• Enforce browser version reporting through enterprise management policies and alert on outdated installs.
• Monitor endpoint process trees for child renderer processes spawning unexpected network activity.
• Track Chrome stable channel announcements via the Chrome Releases blog and integrate update status into vulnerability dashboards.

How to Mitigate CVE-2026-5919

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later on all Windows, macOS, and Linux endpoints.
• Restart browser sessions after the update to ensure the patched binary is active.
• Verify enterprise auto-update policies are functioning and not blocked by group policy or network filtering.

Patch Information

Google addressed CVE-2026-5919 in the stable channel update announced on the Chrome Releases blog. The fix ships in Chrome 147.0.7727.55 and later. Chromium-based browsers downstream of the Chromium 147 release branch should also incorporate the corrected WebSockets validation logic.

Workarounds

• Restrict navigation to untrusted external sites through enterprise web filtering until patching completes.
• Disable or constrain WebSocket usage via browser policy for high-risk user populations where feasible.
• Apply defense-in-depth controls such as site isolation and strict third-party cookie policies to limit data exposure from a successful bypass.

# Verify Chrome version on Linux
google-chrome --version

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion