CVE-2026-14145 - Vulnerability Details

Description

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

Published: 2026-06-30

Score: 6.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A remote attacker can exploit an incorrect handling of CSS in Google Chrome versions prior to 150.0.7871.47 to inject arbitrary scripts or HTML into a page rendered by the browser. The injected payload runs in the context of the target web page, enabling execution of user‑supplied code. This flaw is a classic example of CWE‑79, where inputs are not properly neutralized.

Affected Systems

All installations of Google Chrome with a version older than 150.0.7871.47 run at risk. The vulnerability affects every operating system that the browser supports, and no specific platform is excluded in the CVE data.

Risk and Exploitability

The CVSS score of 6.1 classifies this as a medium‑severity issue, and the EPSS score indicates a very low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. An attacker must serve or provide a maliciously crafted HTML page that the user opens or visits, so user interaction is required and no privileges or elevated access are needed for exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.47,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Google Chrome to version 150.0.7871.47 or later.
Enable Chrome’s auto‑update feature to receive future security patches automatically.
Implement a Content Security Policy that blocks inline styles and script execution, mitigating the input validation weakness identified as CWE‑79.

Generated by OpenCVE AI on July 15, 2026 at 23:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00154.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/514485825

History

Wed, 15 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		CSS‑Based Cross‑Site Scripting in Google Chrome

Tue, 14 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title	Google Chrome CSS Exploit Enabling Remote Script Injection (UXSS)

Tue, 14 Jul 2026 00:45:00 +0000

Type	Values Removed	Values Added
Title		Google Chrome CSS Exploit Enabling Remote Script Injection (UXSS)

Mon, 13 Jul 2026 05:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome CSS UXSS Exploit Enables Script Injection

Sun, 12 Jul 2026 10:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome CSS UXSS Exploit Enables Script Injection

Sat, 11 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title	Injectable CSS Allows Remote Script Execution (UXSS) in Chrome before 150.0.7871.47

Fri, 10 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Title		Injectable CSS Allows Remote Script Execution (UXSS) in Chrome before 150.0.7871.47

Thu, 09 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title	Remote CSS-based Script Injection (UXSS) in Google Chrome

Wed, 08 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Remote CSS-based Script Injection (UXSS) in Google Chrome

Tue, 07 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Title	CSS Parser Allows Remote Script Injection in Google Chrome

Mon, 06 Jul 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title		CSS Parser Allows Remote Script Injection in Google Chrome

Mon, 06 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
Title	Chrome CSS injection vulnerability allows execution of arbitrary scripts

Sun, 05 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title		Chrome CSS injection vulnerability allows execution of arbitrary scripts

Sun, 05 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Title	Inappropriate CSS Implementation Enabling Remote Script Injection in Google Chrome

Sat, 04 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title		Inappropriate CSS Implementation Enabling Remote Script Injection in Google Chrome

Sat, 04 Jul 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title	Insecure CSS Implementation Enables Remote Script Injection

Fri, 03 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		Insecure CSS Implementation Enables Remote Script Injection

Fri, 03 Jul 2026 08:30:00 +0000

Type	Values Removed	Values Added
Title	UXSS via CSS Injection in Chrome before 150.0.7871.47

Thu, 02 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title		UXSS via CSS Injection in Chrome before 150.0.7871.47

Thu, 02 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title	Cross‑Site Scripting via CSS Parsing in Google Chrome

Thu, 02 Jul 2026 00:00:00 +0000

Type	Values Removed	Values Added
Title		Cross‑Site Scripting via CSS Parsing in Google Chrome

Wed, 01 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Title	Chrome CSS‑Driven UXSS Script Injection Vulnerability

Wed, 01 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		Chrome CSS‑Driven UXSS Script Injection Vulnerability
Weaknesses		CWE-79

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/514485825

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:39:43.442Z

Updated: 2026-07-01T14:21:39.904Z

Reserved: 2026-06-29T23:11:50.897Z

Link: CVE-2026-14145

Vulnrichment

Updated: 2026-07-01T14:17:27.693Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-15T23:15:15Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object