EUVD-2026-34583
GHSA-5wrr-98hx-x2qx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's Keyboard implementation prior to version 149.0.7827.53 enables remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. The Scope:Changed CVSS vector reflects the fundamental nature of this class: successful exploitation bypasses the Same-Origin Policy, potentially granting script access to sessions, cookies, and DOM content across all origins open in the browser. No public exploit has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) indicates low current exploitation probability, though UXSS primitives are historically high-value for targeted attacks.
Technical ContextAI
The vulnerability resides in Chrome's Keyboard API implementation (the browser component handling keyboard input and related events). CWE-358 (Improperly Implemented Security Check for Standard) indicates that an established security standard - in this case the Same-Origin Policy or a related browser security invariant - is referenced but incorrectly enforced in the Keyboard subsystem's code. Universal XSS (UXSS) is distinct from conventional reflected or stored XSS: rather than exploiting a flaw in a web application, it exploits the browser engine itself to execute scripts in the context of arbitrary origins, circumventing the isolation boundary that prevents cross-origin JavaScript access. The affected component is Google Chrome (Chromium-based) across desktop platforms, all versions prior to 149.0.7827.53, as identified by the EUVD affected-version range 'Chrome 149.0.7827.53 < 149.0.7827.53' and the Chrome Releases advisory. Chromium classified the severity internally as Medium.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later immediately; this is the vendor-confirmed fixed release per the Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this update in most managed and consumer environments - verify the installed version via chrome://settings/help. For environments where immediate patching is not feasible, meaningful compensating controls are limited given the browser's attack surface, but defenders can restrict end-user browsing to known-safe URL allowlists via enterprise policy (Chrome's URLAllowList/URLBlockList), disable JavaScript execution for untrusted sites using Chrome's Site Settings policies, or enforce Enhanced Safe Browsing to reduce likelihood of users reaching attacker-controlled pages. These controls reduce exposure but do not eliminate the underlying flaw and carry trade-offs in user functionality. No workaround is confirmed to fully mitigate UXSS-class vulnerabilities short of patching.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Code Injection
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today