CVE-2026-5892
Google Chrome ≤ 147.0.7727.55
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:HSummary
CVE-2026-5892 is a medium-severity Policy Privileges are not Assigned Consistently Between Control and Data Agents (CWE-1268) vulnerability in Google Chrome. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-49 (Hardware-enforced Separation and Policy Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20711
Vulnerability Data
Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-49 explicitly requires hardware-enforced separation and policy enforcement mechanisms, directly addressing the hardware access-control inconsistency described by the weakness.
AC-3 requires consistent enforcement of authorizations for all access requests, directly stopping inconsistent control vs. data policy privileges from being exploitable.
AC-24 mandates that access control decisions apply the correct policy to every request, preventing privilege discrepancies between agents from being introduced or used.
SC-3 isolates security functions and their policies from other functionality, structurally avoiding inconsistent privilege assignments between control and data paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 policy/least-privilege practices can surface inconsistent privilege definitions (partial prevention) but do not address hardware-specific control-vs-data agent discrepancies at all (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly governs the assignment and review of access rights, addressing inconsistent privilege mappings between agents.
Specifies management of privileged access rights, mitigating discrepancies between control-plane and data-plane privileges.
Defines the overarching access-control policy that should enforce consistent privileges between control and data agents.
Implements technical restrictions on information access that can prevent inconsistent privilege enforcement.
Restricts privileged utility programs, indirectly reducing risk of inconsistent privilege use but not addressing policy mapping.