EUVD-2026-28127Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H reflects mandatory renderer-compromise prerequisite; S:C reflects UXSS crossing origin boundaries into other browsing contexts.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Universal Cross-Site Scripting (UXSS) via MHTML mishandling in Google Chrome prior to 148.0.7778.96 allows a remote attacker - who has first compromised the renderer process - to inject arbitrary scripts or HTML that bypass the Same-Origin Policy, potentially reading cookies and session data across all open origins. The attack is a two-stage chain: a separate renderer exploit must precede this MHTML-based UXSS, substantially raising real-world complexity beyond the raw CVSS score implies. No public exploit or active exploitation has been identified; EPSS sits at 0.03% (7th percentile) and SSVC rates exploitation status as none.
Technical ContextAI
MHTML (MIME Encapsulation of Aggregate HTML Documents, RFC 2557) is a single-file web archive format supported by Chrome for saving and rendering complete web pages. An inappropriate implementation in Chrome's MHTML parser/renderer allows a compromised renderer process to construct content that escapes origin boundaries - a condition known as UXSS (Universal XSS). Unlike conventional XSS, which is scoped to one origin, UXSS compromises the browser's Same-Origin Policy globally, enabling script execution in arbitrary origin contexts and access to cross-origin cookies, localStorage, and DOM. The root-cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), reflecting insufficient sanitization or incorrect context enforcement during MHTML document processing. Affected product per CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms (Windows, macOS, Linux), with downstream packaging impact noted for Red Hat and SUSE Linux distributions.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later, as confirmed by the vendor stable-channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deploy this to most desktop installations automatically; verify the installed version via chrome://settings/help. Enterprise administrators managing Chrome via policy should push the update through Chrome Browser Cloud Management or group policy. Users on Red Hat or SUSE Linux should apply patched Chromium packages via dnf or zypper once released by those vendors. As a compensating control pending patch deployment, ensuring Chrome's Site Isolation and renderer sandbox features remain enabled (both are on by default; do not disable via command-line flags or enterprise policy) limits the blast radius of any renderer compromise and reduces the exploitability window for this MHTML flaw.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today