EUVD-2026-50684
GHSA-h3vg-f6h9-5vvf
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
UXSS crosses browser origin boundaries warranting S:C; no attacker auth needed (PR:N); user must visit the page (UI:R); no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 allows a remote unauthenticated attacker to inject arbitrary scripts or HTML that can escape the browser's same-origin policy by delivering a crafted HTML page to an unsuspecting victim. All Chrome installations below 151.0.7922.72 across supported platforms are affected, with partial confidentiality and integrity impact. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' confirm low current exploitation probability, though UXSS primitives carry disproportionate value for credential and session theft.
Technical ContextAI
The flaw resides in Chrome's Autofill subsystem - the built-in browser feature that automatically populates form fields with stored user data. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), with the specific variant being UXSS (Universal XSS). Unlike conventional reflected or stored XSS, UXSS exploits flaws in browser internals rather than web application logic, enabling injected scripts to potentially operate across the browser's same-origin policy boundaries and access content from arbitrary origins. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions on all platforms prior to 151.0.7922.72. Chromium's internal severity rating is Medium, suggesting exploitation constraints limit the practical cross-origin impact scope. The inappropriate implementation label indicates incorrect handling of attacker-influenced content within the Autofill processing pipeline rather than a memory corruption class of vulnerability.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released fix as documented in the Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most consumer Chrome installations will update automatically; enterprise environments should verify deployment via Chrome Browser Cloud Management or Group Policy (GoogleUpdate policies). For organizations unable to immediately apply the patch, disabling Chrome Autofill via enterprise policy ('AutofillAddressEnabled: false' and 'AutofillCreditCardEnabled: false') may remove the vulnerable code path as a compensating control, at the cost of end-user form-completion convenience. Deploying a remote browser isolation (RBI) solution for high-risk users can contain UXSS impact by preventing cross-origin script reach. Web filtering to block navigation to untrusted or unknown HTML pages reduces attacker delivery surface but does not eliminate risk from compromised legitimate sites.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today