EUVD-2026-37544Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered UXSS requires only user navigation (UI:R, PR:N, AC:L); Serial API default-enabled; cross-origin script injection changes scope (S:C) with limited confidentiality and integrity impact and no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's Serial API implementation prior to version 149.0.7827.155 allows a remote, unauthenticated attacker to inject and execute arbitrary scripts or HTML across any browser origin by luring a user to a crafted HTML page. The Scope:Changed CVSS metric underscores the cross-origin nature of this flaw, which bypasses the Same-Origin Policy and can affect trusted co-loaded or previously visited sites. No active exploitation has been confirmed by CISA KEV, and EPSS at 0.27% (18th percentile) alongside SSVC 'exploitation: none' signal low real-world exploitation activity at time of analysis. Vendor-released patch: 149.0.7827.155.
Technical ContextAI
The vulnerability resides in Chrome's implementation of the Web Serial API (a browser feature allowing web pages to communicate with serial hardware devices), classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). The specific variant here is UXSS (Universal XSS), which is more severe than standard reflected or stored XSS because it allows injected scripts to execute in the security context of arbitrary origins - not just the attacker's domain - effectively circumventing the Same-Origin Policy. The CVSS S:C (Scope:Changed) metric confirms this cross-origin impact. Affected products per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* cover all Chrome desktop versions prior to 149.0.7827.155 on all platforms. Tags referencing Red Hat and SUSE indicate downstream Chromium-based packages in Linux distributions are also within scope.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.155 or later - this is the vendor-released patch confirmed via the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html and corroborated by EUVD-2026-37544. Chrome's auto-update mechanism should apply this automatically for most consumer deployments; enterprise environments managed via policy should force-update and verify version compliance. Users on Red Hat or SUSE Linux distributions running Chromium packages should apply updated packages from official distribution repositories as they become available. As a compensating control prior to patching, enterprise administrators can restrict or disable the Web Serial API using Chrome enterprise policies such as DefaultSerialGuardSetting set to BlockSerial (value 2) or SerialBlockedForUrls - note this will break legitimate web-based serial device management applications. Restricting navigation to untrusted external sites via proxy or DNS filtering reduces exposure surface but does not eliminate risk for all attacker delivery vectors.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today