EUVD-2026-42456
GHSA-6wj6-669x-mjrf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via crafted page (AV:N), no attacker privileges needed (PR:N), victim must visit the page (UI:R), cross-origin UXSS triggers scope change (S:C), with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's WebGL implementation prior to version 150.0.7871.115 allows remote attackers to bypass the Same-Origin Policy and inject arbitrary scripts or HTML into cross-origin contexts via a crafted HTML page. The vulnerability carries a scope change (S:C) in its CVSS vector, reflecting the cross-origin boundary violation inherent to UXSS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running Google Chrome for desktop at a version below 150.0.7871.115 and must actively navigate to an attacker-controlled HTML page containing the malicious WebGL content (CVSS UI:R confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 Medium score, while numerically modest, understates the qualitative risk of a UXSS primitive: the scope change (S:C) signals cross-origin boundary bypass, enabling an attacker to access session tokens, cookies, and sensitive data across any origin the victim has authenticated to. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious HTML page embedding specially constructed WebGL content that triggers the inappropriate implementation flaw in unpatched Chrome. When a victim browses to this page - via phishing link, malicious advertisement, or compromised legitimate site - the WebGL flaw allows injected scripts to execute across other open origins in the browser, enabling theft of session cookies or authentication tokens from banking, email, or enterprise SaaS applications the victim is logged into. … |
| Remediation | The primary fix is updating Google Chrome to version 150.0.7871.115 or later, available via Google's stable channel as documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today