EUVD-2026-34483
GHSA-xjqx-frcx-9w6g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome for Android's Tab Group Sync feature allows remote unauthenticated attackers to inject arbitrary scripts or HTML via malicious network traffic against Chrome versions prior to 149.0.7827.53. The CVSS Changed Scope (S:C) confirms that injected content escapes the vulnerable component's origin boundary, affecting other origins - the defining characteristic of UXSS, which is more severe than conventional XSS because it bypasses the browser-level same-origin policy rather than just application-level controls. No public exploit has been identified at time of analysis, and EPSS at 0.07% (22nd percentile) reflects low current exploitation probability; the vulnerability is not listed in CISA KEV.
Technical ContextAI
The vulnerable component is Tab Group Sync, a Google Chrome feature on Android that synchronizes tab group state across devices over network channels. CWE-20 (Improper Input Validation) identifies the root cause: the sync mechanism fails to adequately sanitize or validate attacker-influenced data received from the network before processing or rendering it, allowing that data to be interpreted as HTML or JavaScript. This is a browser-engine-level UXSS, distinct from web-application XSS - because the Changed Scope (S:C) in the CVSS:3.1 vector indicates the injected script operates beyond the security boundary of the originating component, crossing into other origins and effectively neutralizing the same-origin policy for the duration of the session. No CPE string was included in the source data; affected product is identified through the ENISA EUVD entry (EUVD-2026-34483) and the Google Chrome Releases advisory as Chrome for Android below version 149.0.7827.53.
RemediationAI
The primary remediation is updating Google Chrome on Android to version 149.0.7827.53 or later, which contains the vendor-released patch as confirmed by the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the ENISA EUVD entry. Users should update through the Google Play Store immediately. In environments where immediate updates cannot be deployed, a targeted compensating control is disabling the Tab Group Sync feature in Chrome settings (Settings > Google > Sync), which eliminates the vulnerable attack surface - the trade-off is loss of cross-device tab group synchronization functionality. Network-level filtering is not a reliable compensating control because the injection occurs through Chrome's own sync channel, not through browser-rendered web content. Enterprise administrators managing Android fleets via MDM or Android Enterprise policies should push the update through managed app update channels and can enforce Tab Group Sync restrictions via Chrome policy until patching is confirmed.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today