EUVD-2026-50576
GHSA-p8m9-4gp6-4xxg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via crafted page requiring user navigation; no auth needed; scope changes due to cross-origin UXSS execution; limited C/I impact with no availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running Google Chrome prior to version 151.0.7922.72 - no special server-side configuration or non-default browser settings are required, as the flaw is in the browser's CSS implementation itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.1 (Medium) is composed of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HTML page containing specially constructed CSS that triggers the inappropriate implementation flaw in Chrome's CSS engine, causing arbitrary JavaScript to execute in the security context of other origins active in the victim's browser session. The attacker delivers the link via phishing email or malvertising; when the victim navigates to the page using an unpatched Chrome instance, the UXSS payload fires and can silently exfiltrate session cookies or authentication tokens from concurrently open tabs such as webmail or banking portals. … |
| Remediation | The primary and complete fix is upgrading Google Chrome to version 151.0.7922.72 or later, confirmed available via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today