EUVD-2026-50677
GHSA-jwcc-m68f-c33r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryHosts page on attacker-controlled or compromised site
-
ExploitVictim opens link in vulnerable Chrome
-
ExecutionChrome Extensions subsystem processes crafted content
-
PersistArbitrary script or HTML injected into browser context
-
ImpactAttacker executes UXSS payload, steals data or manipulates page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must deliver a specially crafted HTML page to a victim running Google Chrome prior to 151.0.7922.72 (CVSS PR:N confirms no attacker authentication is required). User interaction is mandatory - the victim must navigate to or load the malicious page (CVSS UI:R). The vulnerability resides in Chrome's Extensions subsystem, implying the triggering code path involves extension processing of page content; the precise extension configuration required (e.g., whether any extension must be installed, or whether the built-in extension infrastructure is sufficient) is not confirmed from available data - Chromium issue 461167648 is access-restricted. Exploitation is limited by the UI:R requirement (no drive-by without user action) and the requirement to be running a pre-patch Chrome version. The flaw is not platform-specific: Windows, macOS, and Linux Chrome builds are all in scope. |
| Impact | CVSS 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N reflects a moderate base risk: network-reachable, low complexity, no privileges required, but dependent on user interaction and scored with unchanged scope. Notably, the vendor's S:U designation is potentially conservative for a UXSS class vulnerability, which by definition implies cross-origin script execution that challenges the unchanged-scope characterization - defenders should treat the practical impact as potentially exceeding the raw CVSS score if the extension can escalate to cross-origin contexts. EPSS at 0.20% (11th percentile) is very low, indicating exploitation in the wild is not currently widespread. No CISA KEV listing and no known public exploit code corroborate low active-exploitation risk. However, Chrome's ubiquitous deployment means even low-probability exploitation translates to a large absolute attack surface. Risk is elevated for enterprises where users routinely browse untrusted or attacker-controlled pages. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing malicious content designed to trigger the inappropriate extension handling behavior in Chrome's Extensions subsystem. A targeted user is socially engineered into visiting the page - via phishing link, malvertising, or embedded iframe - causing Chrome to process the page through the vulnerable extension code path and execute attacker-controlled scripts or inject HTML in the browser context. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means a working exploit would require minimal sophistication once the specific extension API interaction is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-confirmed patched release documented at the Chrome Releases stable channel advisory (chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's automatic update mechanism will deliver this update to most users; verify the installed version via chrome://settings/help. If immediate patching is not feasible, mitigations should focus on restricting extension permissions - particularly those with broad host access or content-script injection capabilities - via enterprise policy (ExtensionSettings) to reduce the attack surface, though this may impact legitimate extension functionality. For high-risk environments, consider enabling Enhanced Safe Browsing and enforcing navigation controls to block access to untrusted or unknown pages. There are no known effective workarounds that fully substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here as a UXSS variant - a browser-level XSS class that exploits implementation flaws in the browser's extension subsystem rather than a web application. Unlike conventional reflected or stored XSS, UXSS abuses extension APIs or privileged content-script context to inject scripts that can potentially execute across origin boundaries, undermining the Same Origin Policy. The affected product is Google Chrome itself, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions below 151.0.7922.72. The Chromium bug tracker issue 461167648 is referenced but is likely access-restricted, limiting independent technical analysis of the precise code path involved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
S:C chosen over vendor's S:U because UXSS by definition crosses origin boundaries, affecting security scope beyond the loaded page; C/I remain L given described impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB