Technical impact
In Google Chrome versions earlier than 151.0.7922.72 a flaw in CSS handling allows a remote attacker to inject arbitrary scripts or HTML into a rendered page, a vulnerability commonly referred to as UXSS. This flaw permits the attacker to execute code in the context of trusted websites, potentially compromising user data, session tokens, or local resources. The weakness is a typical input validation error, classified as CWE‑79.
Affected Systems
All users running Google Chrome on desktop platforms are affected if their browser version precedes 151.0.7922.72. The affected product is the standard Chrome web browser distributed by Google, with no mention of specific operating system constraints.
Risk and Exploitability
The CVSS score of 6.1 indicates a medium severity, while the EPSS score of less than 1% suggests a low but still possible exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector is a maliciously crafted HTML page or web resource that an unsuspecting user might open or visit. While no active exploitation reports are cited, the flaw’s nature and the presence of a recent patch release implies that exploitation is feasible using standard browser abuse tactics.
Debian DLA
Debian DSA