EUVD-2026-50627
GHSA-cjv6-qcpr-cp2x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery, no privileges needed, but user must visit crafted page; scope changes cross-origin via UXSS with limited confidentiality and integrity impact and no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.
Technical ContextAI
The vulnerability resides in Chrome's CSS parsing or rendering subsystem (per the 'Inappropriate implementation in CSS' classification) and results in a Universal XSS condition - a particularly severe subclass of CWE-79 (Improper Neutralization of Input During Web Page Generation). Unlike ordinary stored or reflected XSS, UXSS exploits flaws in the browser engine itself to bypass the Same-Origin Policy, allowing injected scripts to run in the security context of arbitrary origins. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:* confirms all Chrome application variants are in scope. The CVSS scope metric S:C reflects the cross-origin impact characteristic of UXSS, distinguishing it from typical web-application-level XSS where scope remains unchanged. The Chromium issue tracker reference (issues.chromium.org/issues/522781838) is where the upstream fix was tracked prior to the stable-channel release.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch per the stable-channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism typically deploys this without user action, but administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or equivalent policy tooling and enforce minimum version enforcement. As a compensating control prior to patch deployment, restricting navigation to untrusted external websites via URL allowlists or web filtering can reduce exposure, though this is disruptive in general-purpose environments. Content Security Policy enforcement on individual web applications does not mitigate browser-level UXSS, as the vulnerability bypasses those controls. No workaround fully substitutes for the patch.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today