EUVD-2026-40770
GHSA-q2j9-m6g3-738j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery via crafted page (AV:N, AC:L, PR:N), mandatory user navigation (UI:R), scope change due to cross-origin UXSS impact (S:C), limited confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome before 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by serving a crafted HTML page to a victim user. The flaw stems from insufficient input validation in Chrome's HTML handling (CWE-20), and its Scope:Changed CVSS metric confirms the core danger: injected scripts escape the attacker-controlled origin and execute in the context of other web origins, undermining the browser's same-origin policy. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS stands at 0.18% (8th percentile), consistent with the vendor's own 'Low' Chromium severity classification despite a NVD CVSS score of 6.1.
Technical ContextAI
The vulnerability resides in Google Chrome's HTML parsing and rendering pipeline, specifically in the input validation layer responsible for sanitizing or rejecting untrusted HTML content. CWE-20 (Improper Input Validation) is the root cause class - the engine fails to adequately vet attacker-supplied HTML tokens or attributes before processing, allowing injection of script payloads. The consequence is a UXSS condition: because Chrome shares a single renderer process across browsing contexts in certain scenarios, or fails to enforce origin boundaries on injected content, scripts can execute against origins other than the page they were injected from - bypassing the same-origin policy (SOP). The affected CPE scope covers all Chrome desktop releases prior to 150.0.7871.47 across Windows, macOS, and Linux platforms. UXSS class bugs are historically high-value for credential theft, session hijacking, and cross-origin data exfiltration without requiring any server-side vulnerability.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later via Chrome's built-in updater (Settings → Help → About Google Chrome) or through enterprise deployment tooling such as Google Admin or SCCM. The vendor-released patch is confirmed available per the stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations that cannot immediately deploy the update should consider enforcing SafeBrowsing and Enhanced Protection modes via Chrome enterprise policy, which may block navigation to known malicious pages used as delivery vectors. As a compensating control, browser isolation products (e.g., remote browser isolation) can neutralize UXSS-class attacks by preventing injected scripts from reaching the endpoint. There are no known effective configuration-only workarounds that fully mitigate a UXSS flaw without patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today