EUVD-2026-50594
GHSA-m2qj-q4ch-v3hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page with CSS exploit
-
DeliveryVictim clicks phishing link or malvertising redirect
-
ExploitChrome loads page and processes flawed CSS
-
ExecutionSame-origin policy bypassed via UXSS
-
PersistInjected scripts read cross-origin tab content
-
ImpactSession tokens or credentials exfiltrated to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to navigate to an attacker-controlled or attacker-influenced HTML page using any desktop Chrome version prior to 151.0.7922.72. No authentication, local access, or elevated privileges are required from the attacker (PR:N). The single limiting factor is user interaction (UI:R) - the victim must visit the crafted page, whether via phishing, malvertising, or redirect. No specific Chrome feature, extension, or non-default configuration is required; the flaw exists in the core CSS implementation. Exploitation is bounded by: (1) the user-interaction requirement, preventing fully automated zero-click exploitation; (2) desktop-only scope based on available CPE data - mobile Chrome is not confirmed affected; and (3) the C:L/I:L CVSS impact designation, though as noted, cross-origin session access can meaningfully exceed these ratings in practice. |
| Impact | The CVSS 6.1 Medium score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects low attack complexity, no required privileges, and network reachability - with user interaction (visiting a crafted page) as the sole gatekeeping condition. The C:L/I:L impact metrics may understate practical exposure: because Scope is Changed, a successful UXSS exploit can extract session tokens or credentials from authenticated sessions across any origin the victim has open, which exceeds what C:L typically implies for confined XSS. EPSS at 0.18% (8th percentile) indicates no significant current exploitation activity, and the vulnerability is absent from CISA KEV. No POC is publicly identified at time of analysis. Balanced assessment: this is a medium-priority patch item, not an emergency - the user-interaction requirement meaningfully limits automated mass exploitation, and EPSS confirms low observed activity. However, Chrome's ubiquitous desktop footprint means even targeted exploitation at scale is feasible, and the same-origin bypass elevates the theoretical ceiling of impact. Organizations should target remediation within their next standard patch cycle rather than treating this as deferred maintenance. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page embedding a specially constructed CSS rule or stylesheet that triggers Chrome's flawed implementation, then distributes the link via phishing email or malvertising. When a target running a vulnerable Chrome version visits the page, the CSS flaw causes Chrome to execute attacker-controlled scripts in cross-origin contexts, allowing the attacker to silently read session cookies or tokens from authenticated tabs - such as webmail or corporate SSO portals - open in the same browser. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) indicates no specialized preconditions are required beyond the victim clicking a link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page that exploits an inappropriate CSS implementation. Because this is a UXSS class vulnerability - not ordinary reflected or stored XSS - exploitation bypasses the browser's same-origin policy entirely, potentially exposing authenticated sessions, cookies, and DOM content from any tab open in the browser. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates low current exploitation probability, though UXSS flaws in dominant browsers remain high-value targets.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately; this is the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism handles this for most desktop users - verify by navigating to chrome://settings/help. Enterprise administrators using Google Admin Console or policy-based deployment should confirm rollout completion across managed endpoints and check that update deferrals are not blocking this release. If patching cannot be completed immediately, enabling Chrome's Enhanced Safe Browsing mode (Settings > Privacy and Security > Security) adds heuristic protection against known malicious pages, though it does not eliminate the underlying CSS flaw. Browser isolation or virtual desktop infrastructure can contain cross-origin data leakage as a compensating control with the trade-off of added operational complexity and latency. No configuration-level workaround exists that directly addresses the CSS implementation defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) rooted in an incorrect implementation within Chrome's CSS processing subsystem. UXSS differs fundamentally from application-layer XSS: rather than targeting a specific web application, it exploits a browser-engine defect to escape the same-origin policy, allowing injected scripts to interact with content from any origin loaded in the browser. The CVSS Scope:Changed (S:C) metric confirms this cross-boundary impact. The affected product is broadly identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome installations prior to 151.0.7922.72. The EUVD entry EUVD-2026-50594 corroborates the affected version range. The specific CSS construct or property triggering the flaw is not disclosed in available public data; the Chromium issue tracker entry at https://issues.chromium.org/issues/518112775 may contain additional technical detail but its public accessibility is unconfirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery requires victim page visit (UI:R); Scope:Changed reflects cross-origin escape; C:L/I:L assigned for partial per-origin session exposure with no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB