EUVD-2026-50888
GHSA-gpxf-958m-6mqp
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered attack requires only victim interaction to visit a crafted page; scope change reflects cross-origin UXSS execution with limited confidentiality and integrity impact and no availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.
Technical ContextAI
Blink is the HTML rendering engine embedded in Google Chrome, responsible for parsing and rendering web content and enforcing browser-level security boundaries including the Same-Origin Policy. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: Blink's implementation fails to correctly sanitize or restrict script and HTML injection, enabling UXSS - a privileged variant of cross-site scripting that escapes origin isolation. Unlike reflected or stored XSS, UXSS operates at the browser engine level and can affect any origin loaded in the browser session. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases on all platforms prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, confirmed as the patched release per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in update mechanism should apply this automatically; enterprise administrators using fleet management tools should verify deployment via Chrome Browser Cloud Management or equivalent. As a pre-patch compensating control, web proxy or DNS filtering can block access to untrusted or unknown external domains, reducing drive-by delivery risk - however this limits browsing functionality and does not eliminate the underlying flaw. No patch side effects have been reported in available data.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today