EUVD-2026-37548Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
UXSS grants cross-origin cookie and token read access warranting C:H; renderer pre-compromise drives AC:H; no system privileges needed beyond the renderer chain prerequisite (PR:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in the Views component of Google Chrome on Linux (prior to 149.0.7827.155) enables an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, breaking Chrome's same-origin policy isolation. This is a post-renderer-compromise escalation step in a multi-stage attack chain, Linux-platform specific, requiring prior renderer RCE as a prerequisite. No public exploit code has been identified at time of analysis; EPSS sits at 0.29% (21st percentile), and CISA SSVC assesses exploitation status as none with partial technical impact.
Technical ContextAI
The vulnerability resides in Chrome's Views UI framework - the cross-platform UI toolkit responsible for rendering and layout in the browser process, outside the sandboxed renderer. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or inappropriate handling of renderer-supplied content before it is reflected into the browser's privileged context. UXSS is a browser-level XSS class that transcends same-origin policy by exploiting the browser itself rather than a web application, enabling script execution across arbitrary origins. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with affected versions below 149.0.7827.155 narrows impact to the Linux rendering path in Views specifically, suggesting the flaw involves the Views layer incorrectly propagating or rendering attacker-controlled data from the renderer into browser-process web content in a way that permits cross-origin script injection. The Scope Changed flag (S:C) in the CVSS vector correctly reflects that impact escapes the vulnerable component and reaches other web origins.
RemediationAI
Update Google Chrome on Linux to version 149.0.7827.155 or later, which is the vendor-released patch confirmed via the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Enterprise deployments should use Google's Chrome Browser Cloud Management or policy enforcement mechanisms to mandate the update. Because exploitation requires a pre-compromised renderer process, organizations that also maintain aggressive patching of all renderer-level Chrome CVEs will substantially reduce the attack chain's feasibility - this flaw cannot be triggered in an uncompromised browser instance. If immediate patching is blocked, restricting Chrome on Linux from accessing high-sensitivity web applications (SSO portals, banking, internal admin panels) reduces the blast radius of a successful UXSS injection. No configuration-level workaround exists that disables the Views component without patching; generic sandbox hardening (e.g., enabling site isolation for all sites via '--site-per-process') limits cross-origin impact at the cost of increased memory usage.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today