EUVD-2026-50576
GHSA-p8m9-4gp6-4xxg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via crafted page requiring user navigation; no auth needed; scope changes due to cross-origin UXSS execution; limited C/I impact with no availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. No public exploit has been identified at time of analysis, and an EPSS score of 0.17% (7th percentile) indicates low current exploitation probability; vendor patch is confirmed available at 151.0.7922.72.
Technical ContextAI
The flaw resides in Chrome's CSS parsing and rendering pipeline, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Unlike conventional XSS, UXSS exploits a defect in the browser engine itself - here an 'inappropriate implementation' in CSS processing - to bypass the Same-Origin Policy and execute attacker-controlled JavaScript in the security context of origins the victim has visited. CSS can influence DOM construction and, in certain implementation paths, may allow crafted values to be reflected into script-executable contexts without proper sanitization. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome instances across platforms prior to 151.0.7922.72. The EUVD entry EUVD-2026-50576 corroborates this version boundary. The Chromium issue tracker reference (issues.chromium.org/issues/517693726) may contain root-cause detail but was not included in the provided intelligence.
RemediationAI
The primary and complete fix is upgrading Google Chrome to version 151.0.7922.72 or later, confirmed available via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism will deliver this for most consumer users; enterprise administrators should validate fleet-wide deployment through Chrome Browser Cloud Management or equivalent MDM policy reporting. If immediate upgrade cannot be completed, a partial compensating control is to enforce URL allowlisting via Chrome enterprise policy (URLBlocklist/URLAllowlist) to restrict browsing to known-safe domains, which reduces exposure to attacker-hosted crafted pages - the trade-off is significant operational friction and incomplete protection since legitimate sites could theoretically be used as a vector. Disabling JavaScript globally (DefaultJavaScriptSetting=2) via enterprise policy would prevent the injected script from executing but would render most web applications non-functional and is not operationally viable for most environments. Patching to 151.0.7922.72 is the only complete remediation.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today