EUVD-2026-50627
GHSA-cjv6-qcpr-cp2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page with weaponized CSS
-
DeliveryDeliver page link to victim via phishing or malicious ad
-
ExploitVictim opens page in unpatched Chrome
-
ExecutionCSS parsing triggers UXSS boundary bypass
-
PersistInjected scripts execute across other open origins
-
ImpactExfiltrate session tokens or sensitive DOM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72. The attack requires the victim to actively navigate to or load an attacker-controlled HTML page containing the malicious CSS payload (UI:R). No authentication, plugin, or non-default browser configuration is required on the attacker side (PR:N, AC:L). The primary limiting factor is user interaction - the victim must be socially engineered or otherwise directed to the crafted page. No special browser settings, extensions, or server-side configurations are needed. The vulnerability affects the default Chrome installation across all standard platforms covered by the CPE. |
| Impact | The CVSS base score of 6.1 (Medium) is anchored by AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, no privileges needed, but requiring user interaction. The S:C flag elevates the score above a typical web XSS finding because cross-origin script execution can compromise sessions, steal credentials, or exfiltrate data from sites the victim has open. However, the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation activity in threat intelligence feeds, and no CISA KEV listing is present, suggesting this has not been weaponized at scale. The Medium Chromium severity rating is consistent with the requirement for user interaction as a limiting factor. Practically, this is a genuine browser security boundary bypass, but the exploitation window is already closing given the patch is available. For organizations with managed Chrome fleets running versions below 151.0.7922.72, patching is the clear priority; unpatched endpoints represent meaningful risk given Chrome's ubiquity. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing malicious CSS constructs that trigger the inappropriate implementation in Chrome's CSS engine. When a victim using an unpatched Chrome version visits the page - via phishing link, malicious ad, or compromised website - the UXSS payload executes in the security context of other origins open in the browser, enabling session cookie theft, credential harvesting from other tabs, or DOM manipulation of trusted sites. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means a working exploit requires no special conditions beyond delivering the crafted page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch per the stable-channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism typically deploys this without user action, but administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or equivalent policy tooling and enforce minimum version enforcement. As a compensating control prior to patch deployment, restricting navigation to untrusted external websites via URL allowlists or web filtering can reduce exposure, though this is disruptive in general-purpose environments. Content Security Policy enforcement on individual web applications does not mitigate browser-level UXSS, as the vulnerability bypasses those controls. No workaround fully substitutes for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's CSS parsing or rendering subsystem (per the 'Inappropriate implementation in CSS' classification) and results in a Universal XSS condition - a particularly severe subclass of CWE-79 (Improper Neutralization of Input During Web Page Generation). Unlike ordinary stored or reflected XSS, UXSS exploits flaws in the browser engine itself to bypass the Same-Origin Policy, allowing injected scripts to run in the security context of arbitrary origins. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:* confirms all Chrome application variants are in scope. The CVSS scope metric S:C reflects the cross-origin impact characteristic of UXSS, distinguishing it from typical web-application-level XSS where scope remains unchanged. The Chromium issue tracker reference (issues.chromium.org/issues/522781838) is where the upstream fix was tracked prior to the stable-channel release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery, no privileges needed, but user must visit crafted page; scope changes cross-origin via UXSS with limited confidentiality and integrity impact and no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB