EUVD-2026-40834
GHSA-qr77-r8m9-548x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered exploit requiring only a user page visit (PR:N, UI:R); S:C reflects UXSS cross-origin script execution; C:L/I:L captures partial cross-origin data access and modification with no availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 150.0.7871.47 allows remote attackers to inject arbitrary scripts or HTML across origin boundaries by exploiting an inappropriate implementation in Chrome's CSS engine via a crafted HTML page. Unlike application-level XSS, this browser-level flaw bypasses same-origin protections, meaning injected scripts can execute in the context of any open origin. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a patch-promptly, not emergency-response, priority.
Technical ContextAI
The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), manifesting specifically as an 'inappropriate implementation' within Chrome's CSS parsing and rendering pipeline. UXSS is a browser-engine-level vulnerability class distinct from web-application XSS: rather than exploiting a flaw in a specific website, it exploits the browser itself to escape the same-origin policy and execute attacker-controlled script in the security context of arbitrary origins. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome desktop builds prior to 150.0.7871.47. The CVSS S:C (Scope Changed) metric reflects this cross-origin impact characteristic. The 'Suse' tag indicates that downstream Chromium packages shipped in SUSE Linux distributions are also in scope and subject to a separate patching cadence from the upstream Chrome release.
RemediationAI
Vendor-released patch: Chrome 150.0.7871.47. Apply the update immediately via Chrome's built-in auto-update mechanism (Help > About Google Chrome), which will deliver version 150.0.7871.47 or later to consumer and standard enterprise users automatically. Enterprise environments managing Chrome via Chrome Browser Cloud Management, Intune, or Group Policy should verify that managed devices have received and applied the update, referencing the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For SUSE Linux deployments running Chromium packages, monitor the SUSE Security Advisory channel for updated chromium RPM packages; the upstream fix may not land in SUSE repositories simultaneously with the Chrome stable release, introducing a window of exposure. No known configuration-based workaround exists since the flaw is within the CSS engine's core implementation; disabling JavaScript via enterprise policy would prevent UXSS payload execution but would break the vast majority of web applications and is not a practical compensating control for most environments.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today