EUVD-2026-50594
GHSA-m2qj-q4ch-v3hw
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery requires victim page visit (UI:R); Scope:Changed reflects cross-origin escape; C:L/I:L assigned for partial per-origin session exposure with no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page that exploits an inappropriate CSS implementation. Because this is a UXSS class vulnerability - not ordinary reflected or stored XSS - exploitation bypasses the browser's same-origin policy entirely, potentially exposing authenticated sessions, cookies, and DOM content from any tab open in the browser. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates low current exploitation probability, though UXSS flaws in dominant browsers remain high-value targets.
Technical ContextAI
The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) rooted in an incorrect implementation within Chrome's CSS processing subsystem. UXSS differs fundamentally from application-layer XSS: rather than targeting a specific web application, it exploits a browser-engine defect to escape the same-origin policy, allowing injected scripts to interact with content from any origin loaded in the browser. The CVSS Scope:Changed (S:C) metric confirms this cross-boundary impact. The affected product is broadly identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome installations prior to 151.0.7922.72. The EUVD entry EUVD-2026-50594 corroborates the affected version range. The specific CSS construct or property triggering the flaw is not disclosed in available public data; the Chromium issue tracker entry at https://issues.chromium.org/issues/518112775 may contain additional technical detail but its public accessibility is unconfirmed.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately; this is the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism handles this for most desktop users - verify by navigating to chrome://settings/help. Enterprise administrators using Google Admin Console or policy-based deployment should confirm rollout completion across managed endpoints and check that update deferrals are not blocking this release. If patching cannot be completed immediately, enabling Chrome's Enhanced Safe Browsing mode (Settings > Privacy and Security > Security) adds heuristic protection against known malicious pages, though it does not eliminate the underlying CSS flaw. Browser isolation or virtual desktop infrastructure can contain cross-origin data leakage as a compensating control with the trade-off of added operational complexity and latency. No configuration-level workaround exists that directly addresses the CSS implementation defect.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today