EUVD-2026-50767
GHSA-rgcf-qx52-6g7x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim clicks phishing link or encounters malicious ad
-
ExploitUnpatched Chrome loads page and mishandles network request
-
ExecutionUXSS payload injected across origin boundary
-
PersistAttacker script executes in victim's browser context of targeted origin
-
ImpactSession tokens or page data exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively navigate to or load attacker-controlled HTML content in an unpatched Chrome browser prior to version 151.0.7922.72 - this is the UI:R (user interaction required) condition encoded in the CVSS vector. No authentication or special privileges are required from the attacker (PR:N), and no non-default browser configuration or feature flag is needed beyond running an affected Chrome version. Exploitation is meaningfully limited by the user interaction barrier: the attack cannot succeed unless the victim visits the malicious page. Additionally, impact is constrained to limited confidentiality and integrity (C:L/I:L) - full account takeover would require chaining subsequent attacker actions after script injection. |
| Impact | The CVSS 6.1 Medium score reflects a network-accessible, no-privilege, user-interaction-required attack with limited confidentiality and integrity impact but a scope change. Real-world risk signals are mixed: EPSS of 0.17% at the 7th percentile is notably low, suggesting most exploitation prediction models do not flag this as an imminent threat, and there is no CISA KEV listing. The Chromium security team itself rated this Medium severity. However, Chrome's ubiquitous deployment means even a low exploitation rate translates to large absolute exposure. The user interaction requirement (UI:R) is a meaningful mitigating factor - passive exploitation against unvisited sites is not possible. Overall, this is a real but lower-priority issue: patch in the next standard update cycle rather than an emergency rollout, unless threat intelligence changes. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that triggers the inappropriate network handling in Chrome, causing it to inject attacker-controlled script into the context of a different origin - for example, a banking or identity provider site already open in the victim's browser. The victim is lured to the attacker's page via phishing, a malicious ad, or a compromised site, and upon page load the UXSS payload executes silently, potentially harvesting session tokens or performing actions on the victim's behalf on targeted origins. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component allows remote attackers to inject arbitrary scripts or HTML across same-origin policy boundaries via a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Unlike application-level XSS, UXSS exploits a flaw in the browser engine itself, enabling cross-origin script execution that bypasses website-level security controls. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), but the confirmed scope change (S:C in CVSS) signals genuine cross-origin impact potential.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise environments should push the update via Google Chrome's enterprise management (e.g., Google Admin, Intune) or allow Chrome's auto-update mechanism to apply it. As a compensating control prior to patching, organizations can enforce Chrome enterprise policies to restrict navigation to known-good URL allowlists, though this carries a significant productivity trade-off. Blocking or sandboxing untrusted web content at the proxy or DNS layer can also reduce attack surface for drive-by scenarios. There are no non-update workarounds that fully mitigate browser-engine-level UXSS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 (Cross-site Scripting) here manifests as UXSS - a browser-level variant that exploits improper handling within Chrome's Network component rather than a flaw in any specific web application. Where standard XSS is confined to the vulnerable site's origin, UXSS leverages the browser's own logic errors to inject scripts that execute across origin boundaries, undermining the same-origin policy enforced by the browser. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome releases across platforms up to the fix version. The CVSS Scope:Changed metric is the technical signal confirming cross-origin impact, consistent with UXSS behavior where the exploited component (Chrome's network layer) affects resources in other origins beyond the attacker's page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered UXSS requires only victim page visit (PR:N, UI:R); cross-origin script injection justifies S:C; C:L/I:L reflect limited but real cross-origin data access and manipulation.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB