EUVD-2026-42457
GHSA-c8mv-ch2p-4gwv
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered UXSS requiring one user interaction (UI:R); S:C reflects cross-origin script execution; C:L/I:L captures partial cross-origin data access; no availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's Forms implementation prior to version 150.0.7871.115 permits remote, unauthenticated attackers to inject arbitrary scripts or HTML across any browser origin by luring a victim to a crafted HTML page. The Scope:Changed metric in the CVSS vector reflects the defining characteristic of UXSS: unlike conventional XSS, the injected script executes outside the attacker-controlled page's origin, effectively bypassing the Same-Origin Policy and threatening any concurrent browser session. No public exploit code or confirmed active exploitation has been identified at time of analysis; SSVC rates exploitation as none and the attack as non-automatable due to the required user interaction.
Technical ContextAI
The vulnerability resides in Chrome's Forms subsystem - the browser-level implementation of HTML form elements - rather than in any specific web application. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: the Forms renderer fails to sanitize or correctly constrain content in a way that allows attacker-controlled HTML or script to escape its expected context. What elevates this above application-layer XSS is its UXSS classification: a browser implementation bug that allows injected scripts to operate across origins, circumventing the Same-Origin Policy at the platform level. All desktop platforms running Google Chrome prior to 150.0.7871.115 (Windows, macOS, Linux) are affected; no CPE string was supplied in the source data, but the EUVD confirms the version boundary as any Chrome release below 150.0.7871.115.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.115 or later, the vendor-released patch confirmed by the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Chrome's auto-update mechanism will deliver this to most consumer installs; enterprise administrators should verify deployment via Google Admin Console or browser management policy and confirm the version floor at 150.0.7871.115 across managed endpoints. No practical workaround exists that disables the HTML Forms component without breaking fundamental browser functionality, as form elements are integral to normal web operation. As a short-term compensating control in environments where immediate patching is blocked, restricting user navigation to untrusted or external sites via proxy policy or DNS filtering reduces exposure, but this control carries significant operational impact and should not substitute for patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today