EUVD-2026-50576
GHSA-p8m9-4gp6-4xxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML/CSS page
-
DeliveryDeliver link via phishing or malvertising
-
ExploitVictim loads page in Chrome < 151.0.7922.72
-
ExecutionCSS flaw triggers UXSS payload
-
PersistScript executes across same-origin boundaries
-
ImpactExfiltrate session tokens or credentials from other tabs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 - no special server-side configuration or non-default browser settings are required, as the flaw is in the browser's CSS implementation itself. The CVSS PR:N metric confirms the attacker requires no authentication or account on the target system. UI:R indicates the victim must navigate to (or be redirected to) the attacker-controlled HTML page; purely server-side or automated exploitation is not applicable. Scope change (S:C) activates once the victim's browser loads the crafted page, enabling cross-origin script execution against other tabs in the same session. Limiting factors: victim must use Google Chrome specifically (not other browsers); victim must be on a version below 151.0.7922.72; and the attacker must succeed in social engineering or traffic injection to deliver the crafted page. Auto-updated Chrome instances or those managed under strict enterprise patch policies are unexploitable. |
| Impact | The CVSS 3.1 score of 6.1 (Medium) is composed of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The Scope:Changed metric is the most operationally significant signal here: it indicates that a successfully triggered UXSS payload can read and write data from arbitrary origins, enabling session hijacking, credential theft, or cookie exfiltration across all tabs active in the same browser instance. Despite this cross-origin potential, the EPSS score of 0.17% at the 7th percentile is low, there is no CISA KEV listing, and no public POC has been identified - signals pointing to no known widespread or automated exploitation at time of analysis. The user interaction requirement (UI:R) further reduces opportunistic risk relative to a fully drive-by vector, though phishing and malvertising remain viable delivery mechanisms. Overall, this is a standard patch-cycle priority for most organizations; the elevated cross-origin capability warrants faster patching in environments where users access sensitive authenticated sessions through Chrome. |
| Exploit ScenarioDerived | An attacker crafts an HTML page containing specially constructed CSS that triggers the inappropriate implementation flaw in Chrome's CSS engine, causing arbitrary JavaScript to execute in the security context of other origins active in the victim's browser session. The attacker delivers the link via phishing email or malvertising; when the victim navigates to the page using an unpatched Chrome instance, the UXSS payload fires and can silently exfiltrate session cookies or authentication tokens from concurrently open tabs such as webmail or banking portals. No public POC has been identified at time of analysis, meaning exploitation currently requires attacker-developed capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. No public exploit has been identified at time of analysis, and an EPSS score of 0.17% (7th percentile) indicates low current exploitation probability; vendor patch is confirmed available at 151.0.7922.72.
RemediationAI
The primary and complete fix is upgrading Google Chrome to version 151.0.7922.72 or later, confirmed available via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism will deliver this for most consumer users; enterprise administrators should validate fleet-wide deployment through Chrome Browser Cloud Management or equivalent MDM policy reporting. If immediate upgrade cannot be completed, a partial compensating control is to enforce URL allowlisting via Chrome enterprise policy (URLBlocklist/URLAllowlist) to restrict browsing to known-safe domains, which reduces exposure to attacker-hosted crafted pages - the trade-off is significant operational friction and incomplete protection since legitimate sites could theoretically be used as a vector. Disabling JavaScript globally (DefaultJavaScriptSetting=2) via enterprise policy would prevent the injected script from executing but would render most web applications non-functional and is not operationally viable for most environments. Patching to 151.0.7922.72 is the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's CSS parsing and rendering pipeline, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Unlike conventional XSS, UXSS exploits a defect in the browser engine itself - here an 'inappropriate implementation' in CSS processing - to bypass the Same-Origin Policy and execute attacker-controlled JavaScript in the security context of origins the victim has visited. CSS can influence DOM construction and, in certain implementation paths, may allow crafted values to be reflected into script-executable contexts without proper sanitization. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome instances across platforms prior to 151.0.7922.72. The EUVD entry EUVD-2026-50576 corroborates this version boundary. The Chromium issue tracker reference (issues.chromium.org/issues/517693726) may contain root-cause detail but was not included in the provided intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via crafted page requiring user navigation; no auth needed; scope changes due to cross-origin UXSS execution; limited C/I impact with no availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB