EUVD-2026-42456
GHSA-6wj6-669x-mjrf
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered via crafted page (AV:N), no attacker privileges needed (PR:N), victim must visit the page (UI:R), cross-origin UXSS triggers scope change (S:C), with limited confidentiality and integrity impact and no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's WebGL implementation prior to version 150.0.7871.115 allows remote attackers to bypass the Same-Origin Policy and inject arbitrary scripts or HTML into cross-origin contexts via a crafted HTML page. The vulnerability carries a scope change (S:C) in its CVSS vector, reflecting the cross-origin boundary violation inherent to UXSS. No public exploit has been identified at time of analysis, and CISA's SSVC assessment marks exploitation status as none with no automatable exploitation path, reducing immediate real-world urgency despite the sensitivity of cross-origin script execution.
Technical ContextAI
WebGL (Web Graphics Library) is a browser-native JavaScript API enabling hardware-accelerated 2D and 3D graphics rendering without plugins, exposed across all major desktop browsers. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting here as an 'inappropriate implementation' in Chrome's WebGL subsystem that creates a cross-origin script injection pathway - the defining characteristic of UXSS. Unlike conventional reflected or stored XSS confined to a single origin, UXSS exploits browser-level flaws to execute injected scripts across multiple security origins simultaneously, effectively nullifying the Same-Origin Policy. The CVSS scope change metric (S:C) directly encodes this: successful exploitation impacts resources beyond the origin of the vulnerable component itself. No CPE strings were provided in the input data, but the EUVD confirms the affected range as Chrome versions below 150.0.7871.115 on desktop platforms.
RemediationAI
The primary fix is updating Google Chrome to version 150.0.7871.115 or later, available via Google's stable channel as documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Chrome's built-in auto-update mechanism delivers this silently in consumer and most enterprise environments; administrators should verify deployment via chrome://settings/help or fleet management tooling. For environments where immediate update is not feasible, disabling WebGL via Chrome Enterprise policy (set 'Disable3DAPIs' to true, or launch with the --disable-webgl flag) eliminates the attack surface entirely, with the trade-off of breaking WebGL-dependent applications such as web-based 3D tools, games, and visualization platforms. A less disruptive compensating control is restricting navigation to untrusted external sites via web content filtering, which reduces delivery opportunity without breaking WebGL functionality for trusted internal applications.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today