EUVD-2026-28145Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Network delivery via crafted page; AC:H for required specific UI gesture sequence; PR:N as no attacker authentication needed; UI:R mandatory; scope unchanged and C/I both low reflecting browser-context UXSS only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Script injection in Google Chrome's UI layer prior to version 148.0.7778.96 enables Universal Cross-Site Scripting (UXSS), allowing a remote attacker to inject arbitrary scripts or HTML into the browser's execution context. Successful exploitation requires social engineering the victim into performing specific UI gestures while visiting a crafted HTML page. No public exploit has been identified at time of analysis, EPSS sits at 0.01% (1st percentile), and CISA's SSVC framework classifies exploitation status as none with no automatable attack path.
Technical ContextAI
The flaw resides in the UI rendering layer of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is classified under CWE-94 (Improper Control of Generation of Code). The root cause is insufficient neutralization of attacker-supplied content processed through Chrome's UI pipeline, enabling injected scripts or HTML to execute in a privileged browser context - the defining characteristic of UXSS. Unlike conventional XSS targeting a specific web application, UXSS exploits the browser engine itself to bypass same-origin policy protections, potentially reaching cross-origin content. The attack is delivered via a crafted HTML page, meaning the injection surface is the browser's own document/UI handling code rather than a third-party web application. The tags include 'RCE,' but this conflicts with the CVSS impact metrics (C:L/I:L/A:N) and the UXSS classification; the actual impact is browser-scoped script injection, not OS-level remote code execution.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later, as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this patch automatically for most end users; enterprise administrators should confirm rollout via Chrome Browser Cloud Management or Group Policy version enforcement. For Linux environments using Red Hat or SUSE packages, apply the updated Chromium package from the respective distribution's security channel once available. Where immediate patching is not feasible, instruct users to be skeptical of pages that prompt unusual UI interactions or gesture sequences, as this is the required social engineering vector. Enabling Enhanced Safe Browsing in Chrome may reduce exposure to known malicious pages delivering this exploit. The vendor has not documented an official configuration workaround; user awareness and prompt patching are the primary controls.
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today