CVE-2026-5889
published 2026-04-08CVE-2026-5889: Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a…
PriorityP419medium4.3CVSS 3.1
AVNACLPRNUIRSUCLINAN
EPSS
0.10%
1.1th percentile
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | chromium | < chromium 147.0.7727.55-1 (sid) | chromium 147.0.7727.55-1 (sid) |
| chrome | < 147.0.7727.55 | 147.0.7727.55 | |
| chrome | >= 147.0.7727.55 < 147.0.7727.55 | 147.0.7727.55 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 146.0.7680.178 PDFium information disclosure (ID 486906 / WID-SEC-2026-1030)
vuldb·2026-04-11·CVSS 4.3
CVE-2026-5889 [MEDIUM] Google Chrome up to 146.0.7680.178 PDFium information disclosure (ID 486906 / WID-SEC-2026-1030)
A vulnerability was found in Google Chrome and classified as problematic. This affects an unknown function of the component PDFium. The manipulation results in information disclosure.
This vulnerability is known as CVE-2026-5889. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-mp5w-52hw-836r: Cryptographic Flaw in PDFium in Google Chrome prior to 147
ghsa_unreviewed·2026-04-09
CVE-2026-5889 GHSA-mp5w-52hw-836r: Cryptographic Flaw in PDFium in Google Chrome prior to 147
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
OSV
CVE-2026-5889: Cryptographic Flaw in PDFium in Google Chrome prior to 147
osv·2026-04-08·CVSS 4.3
CVE-2026-5889 [MEDIUM] CVE-2026-5889: Cryptographic Flaw in PDFium in Google Chrome prior to 147
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-5889
vendor_chrome·2026-04-22·CVSS 4.3
CVE-2026-5889 [MEDIUM] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-5889
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2026-5889
Red Hat
chromium-browser: Cryptographic Flaw in PDFium
vendor_redhat·2026-04-07·CVSS 4.3
CVE-2026-5889 [MEDIUM] CWE-334 chromium-browser: Cryptographic Flaw in PDFium
chromium-browser: Cryptographic Flaw in PDFium
A cryptographic flaw flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=486906037
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-5888
vendor_chrome·2026-04-07·CVSS 6.5
CVE-2026-5888 [MEDIUM] Stable Channel Update for Desktop: CVE-2026-5888
Stable Channel Update for Desktop
CVE-2026-5888: Uninitialized Use in WebCodecs. Reported by Identified by the Octane Security Team: Giovanni Vignone, Paolo Gentry, Robert van Eijk on 2026-02-22 [TBD][ 486906037 ] Medium CVE-2026-5889: Cryptographic Flaw in PDFium
Reported by mlafon on 2026-02-23 [TBD][ 487259772 ] Medium CVE-2026-5890: Race in WebCodecs
Severity: medium
Debian
CVE-2026-5889: chromium - Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an ...
vendor_debian·2026·CVSS 4.3
CVE-2026-5889 [MEDIUM] CVE-2026-5889: chromium - Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an ...
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
Scope: local
bookworm: open
bullseye: open
forky: open
sid: resolved (fixed in 147.0.7727.55-1)
trixie: open
No detection rules found.
No public exploits indexed.
Sans Isc
Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
blogs_sans_isc·2026-04-14·CVSS 8.8
[HIGH] Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
Microsoft Patch Tuesday April 2026.
Published: 2026-04-14. Last Updated: 2026-04-14 17:46:09 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
This month's Microsoft Patch Tuesday looks like a record one, but let's look at it a bit closer to understand what is happening
The update patches a total of 243 vulnerabilities. However, 78 of them are Chromium issues affecting Microsoft Edge. Patches for Edge were released earlier. This leaves 165 vulnerabilities that are not Edge-related. Of these, 8 are rated critical, and 154 are important. One vulnerability has already been exploited, and another was made public before today but has not yet been seen in the wild.
Noteworthy Vulnerabilities:
CVE-2026-33827 (Windows TCP/IP Remote Code Execution Vulnerability): As a packet nerd, I love thes
Wiz
CVE-2026-5889 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-5889 [HIGH] CVE-2026-5889 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5889 :
Google Chrome vulnerability analysis and mitigation
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
Source : NVD
Published April 8, 2026
CNA Score N/A
Affected Technologies
Google Chrome
Chromium
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:google:chrome
chromium
Sources
NVD
Debian 11, 12, 13, 14 No Fix Added at: Apr 09, 2026
Echo No Fix Added at: Apr 09, 2026
Linux Has Fix Added at: Apr 09, 2026
Windows Has Fix Ad
Bugzilla
CVE-2026-5889 chromium-browser: Cryptographic Flaw in PDFium
bugzilla·2026-04-08·CVSS 4.3
CVE-2026-5889 [MEDIUM] CVE-2026-5889 chromium-browser: Cryptographic Flaw in PDFium
CVE-2026-5889 chromium-browser: Cryptographic Flaw in PDFium
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
2026-04-08
Published