EUVD-2026-34627
GHSA-vr65-6mh9-phcm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's SVG implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to bypass same-origin policy by injecting arbitrary scripts or HTML across origins via a crafted HTML page. Exploitation requires user interaction and high attack complexity (CVSS AC:H/UI:R), and EPSS at 0.06% (18th percentile) reflects limited real-world exploitation activity. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Technical ContextAI
UXSS (Universal Cross-Site Scripting) is a class of browser-engine vulnerability distinct from application-level XSS: rather than exploiting a flaw in a target website, it exploits the browser's own rendering logic to execute attacker-controlled scripts in the security context of any arbitrary origin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) triggered by an inappropriate implementation in Chrome's SVG subsystem. SVG (Scalable Vector Graphics) is a complex XML-based format that supports inline scripting, event handlers, and deep DOM integration, making its parser a historically rich attack surface for same-origin policy bypasses. The vulnerability resides in the Chromium engine and affects Chrome desktop builds prior to 149.0.7827.53, as confirmed by the EUVD entry EUVD-2026-34627 and the Chrome Releases advisory. No CPE strings were supplied in the input data; product scope is drawn from EUVD version range data.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released fix for this SVG implementation flaw. The official Chrome Releases advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this update to most consumer endpoints automatically; enterprise administrators should verify deployment via Google Admin Console, Intune, or equivalent fleet management tooling and confirm the stable channel version has reached 149.0.7827.53. For environments where immediate patching is not feasible, a targeted compensating control is to enforce strict Content Security Policy (CSP) headers with 'script-src' restrictions on internally managed web applications, which limits UXSS script execution surface - note this does not prevent exploitation via attacker-controlled external pages. Restricting user navigation to untrusted URLs through web proxy allow-lists can reduce the UI:R attack surface, but imposes workflow overhead. Chromium-derived browsers sharing the same SVG engine should be assessed against their respective vendor advisories.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today