EUVD-2026-40665
GHSA-j94c-xmv8-5mp2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered page-visit exploit (AV:N, UI:R, PR:N); page-scoped script injection yields limited C/I with no availability impact (S:U, C:L, I:L, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's HTMLParser prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML into a victim's browser context by serving a crafted HTML page. The flaw is classified Medium severity by Google's Chromium security team and carries a CVSS 5.4 score, with EPSS at 0.17% (7th percentile) and no CISA KEV listing, indicating low current exploitation activity. A vendor-released patch exists in Chrome 150.0.7871.47; Chrome's auto-update mechanism substantially narrows the exposure window for most consumer endpoints.
Technical ContextAI
The vulnerability resides in the HTMLParser component of the Chromium rendering engine - the subsystem responsible for tokenizing and constructing the DOM from raw HTML input. Classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), the root cause is an 'inappropriate implementation' in parsing logic that fails to neutralize attacker-controlled HTML constructs before they reach the page execution context. The description characterizes this as UXSS (Universal XSS), a class of browser-level flaw that typically bypasses same-origin policy and allows injected scripts to operate across origins. However, the CVSS vector records S:U (scope unchanged), which is inconsistent with classical UXSS behavior - full UXSS would normally yield S:C. This discrepancy suggests either the cross-origin impact is constrained by additional browser mitigations, or the UXSS label is applied loosely to describe the parser-level injection surface rather than confirmed cross-origin script execution. Affected product per EUVD data: Chrome versions below 150.0.7871.47. No CPE strings were provided in the intelligence data.
RemediationAI
The primary fix is to update Google Chrome to version 150.0.7871.47 or later, confirmed as the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Most consumer endpoints will receive this automatically via Chrome's built-in auto-update; enterprise administrators should verify forced update policies are active and confirm the installed version reaches 150.0.7871.47. For environments with delayed patching cycles, compensating controls include enforcing Safe Browsing at the strictest level via Chrome enterprise policy to block known-malicious URLs, applying URL allowlisting through browser management platforms to restrict navigation to sanctioned sites only (trade-off: significant user friction), and ensuring web applications under your control deploy strict Content-Security-Policy headers to limit the blast radius of any injected script. HttpOnly and Secure flags on session cookies reduce the value of any successfully injected script. Organizations using Chromium-based browsers other than Chrome should monitor those vendors' advisories for equivalent fixes.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today