PT-2026-31513 · Google · Google Chrome

Renwa Hiwa + 1 · Published 2024-10-18 · Updated 2026-05-29 · CVE-2026-5895

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Google Chrome for iOS versions prior to 147.0.7727.55

Description An incorrect security user interface issue in the Omnibox (the browser's address bar) allows a remote attacker to spoof the contents of the URL bar. This is achieved by using a specially crafted domain name, specifically utilizing two Right-to-Left (RTL) Arabic character subdomains to mislead the user.

Recommendations Update Google Chrome for iOS to version 147.0.7727.55 or later.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2026-04985

CVE-2026-5895

OPENSUSE-SU-2026:10530-1

OPENSUSE-SU-2026:20575-1

Affected Products

Google Chrome

References · 75

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5895 · Security Note
• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5895 · Security Note
• https://bdu.fstec.ru/vul/2026-04985 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10530-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5895 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20575-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-5904 · Note
• https://suse.com/security/cve/CVE-2026-5893 · Note
• https://suse.com/security/cve/CVE-2026-5903 · Note
• https://suse.com/security/cve/CVE-2026-5909 · Note
• https://suse.com/security/cve/CVE-2026-5908 · Note
• https://tenable.com/cve/CVE-2026-5895 · Note
• https://suse.com/security/cve/CVE-2026-5867 · Note