Description
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-30
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the handling of CSS in Google Chrome versions before 150.0.7871.47 allows a remote attacker to craft an HTML page that causes arbitrary scripts or HTML to be executed in a victim’s browser. The vulnerability is an instance of Cross‑Site Scripting (CWE‑79).

Affected Systems

Google Chrome is the affected product. All0.7871.47 can be impacted; the vulnerability is fixed in version 150.0.7871.47 and later.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. The EPSS value of less than 1 % reflects a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation is likely remote, requiring a victim to open a crafted HTML page that triggers the as through a malicious link or embedded content.

Generated by OpenCVE AI on July 15, 2026 at 11:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 150.0.7871.47 or later via the official update mechanism. The latest revision includes the fix for the CSS injection flaw.
  • Ensure automatic updates are enabled on all Chrome installations so that future patches are applied promptly.
  • If an immediate upgrade is infeasible, reduce exposure by restricting the loading of external CSS or applying a strict Content Security Policy that disallows inline or untrusted scripts on sites you control.

Generated by OpenCVE AI on July 15, 2026 at 11:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 15 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Google Chrome

Mon, 13 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Google Chrome

Sat, 11 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Title CSS Injection in Google Chrome Allows Remote Script Execution

Fri, 10 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title CSS Injection in Google Chrome Allows Remote Script Execution

Fri, 10 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Remote CSS Injection Leading to Client‑Side XSS in Google Chrome

Thu, 09 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Title Remote CSS Injection Leading to Client‑Side XSS in Google Chrome

Wed, 08 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Chrome

Wed, 08 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Chrome

Tue, 07 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Client‑Side XSS via CSS Injection in Google Chrome

Mon, 06 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Client‑Side XSS via CSS Injection in Google Chrome

Mon, 06 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Cross‑Site Scripting via CSS Injection in Google Chrome

Sun, 05 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Cross‑Site Scripting via CSS Injection in Google Chrome

Sat, 04 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Google Chrome

Sat, 04 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Client‑Side Cross‑Site Scripting via CSS Injection in Google Chrome

Fri, 03 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Google Chrome CSS Bug Permits Arbitrary Script Injection via Crafted Page

Fri, 03 Jul 2026 06:00:00 +0000

Type Values Removed Values Added
Title Google Chrome CSS Bug Permits Arbitrary Script Injection via Crafted Page

Thu, 02 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Google Chrome CSS Rendering Vulnerability Allows Client‑Side Script Injection

Thu, 02 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Google Chrome CSS Rendering Vulnerability Allows Client‑Side Script Injection

Wed, 01 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title CSS Parsing Bug Enables Client‑Side Script Injection in Google Chrome

Wed, 01 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title CSS Parsing Bug Enables Client‑Side Script Injection in Google Chrome

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Title Chrome CSS Injection Enabling Arbitrary Script Execution
Weaknesses CWE-79

Wed, 01 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Chrome CSS Injection Enabling Arbitrary Script Execution
Weaknesses CWE-79

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T15:15:18.356Z

Reserved: 2026-06-29T23:03:29.754Z

Link: CVE-2026-13836

cve-icon Vulnrichment

Updated: 2026-07-01T15:15:13.191Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T11:15:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')