EUVD-2026-28009Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Unvalidated Omnibox input in Google Chrome prior to version 148.0.7778.96 enables remote attackers to inject arbitrary scripts and HTML (universal XSS) via malicious network traffic, affecting users who click on crafted links. The vulnerability requires user interaction but crosses security boundaries due to its scope impact. No active exploitation has been publicly confirmed, though a patch is available from Google.
Technical ContextAI
The Omnibox is Chrome's unified address and search bar, which processes user input and network-sourced suggestions. The vulnerability stems from insufficient input validation (CWE-20: Improper Input Validation) when handling untrusted data from network sources. An attacker can craft malicious network traffic containing script or HTML payloads that bypass the Omnibox's sanitization mechanisms, resulting in universal XSS (UXSS) - code execution within the browser context with access to privileged operations normally restricted by the same-origin policy. This affects the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all versions prior to 148.0.7778.96.
RemediationAI
Vendor-released patch: Upgrade to Google Chrome 148.0.7778.96 or later. Chrome's auto-update mechanism will deploy this patch automatically on most deployments; users can force an immediate update by navigating to Chrome menu → Settings → About → Chrome will automatically check for updates. Organizations deploying Chrome with managed policies should ensure no policies are pinning older versions. No workarounds are available for versions prior to 148.0.7778.96 beyond disabling Omnibox suggestions via enterprise policy (chrome://policy set OmniboxEnabled to false), though this significantly degrades browser usability and is not recommended. Verify patched status by checking chrome://version or chrome://settings/help.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today