CVE-2026-17845

chromium-browser: chromium-browser: Inappropriate implementation in CSS

View on CVE.org
Published Jul 30, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

The vulnerability resides in Chrome’s handling of CSS and enables a remote attacker to inject arbitrary scripts or HTML through a crafted webpage. Such code execution occurs within the browser context, potentially compromising user data and allowing further malicious activity. The weakness is classified under CWE‑79.

Affected Systems

Google Chrome on any platform – all releases earlier than version 151.0.7922.72 are affected.

Risk and Exploitability

The CVSS score of 6.1 indicates medium severity, while the EPSS of less than 1% suggests exploitation is currently rare but possible. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by delivering a specially crafted HTML page, typically by convincing a user to visit or embed content from a malicious website. No special privileges are required beyond normal user interaction with the browser.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or later, which includes the CSS handling patch.
  • Ensure Chrome’s Safe Browsing feature is enabled to help detect malicious or phishing sites that may present UI-based attack content.
  • If managing Chromium deployments, enforce a Content‑Security‑Policy or use extensions that block unauthorized script execution, addressing the injection weakness described by CWE‑79.

Generated by OpenCVE AI on August 2, 2026 at 06:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}
Type Values Removed Values Added
Title chromium-browser: chromium-browser: Inappropriate implementation in CSS
Weaknesses CWE-79
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
References
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jul 31, 2026, 3:39 PM
Reserved
Jul 27, 2026, 11:35 PM

View source JSON

Updated
Jul 31, 2026, 3:39 PM

JSON

Status
Analyzed
Published
Jul 30, 2026, 1:16 AM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

Severity
Moderate
Public date
Jul 30, 2026, 12:19 AM

View source Bugzilla JSON

Updated
Aug 2, 2026, 6:45 AM

JSON