Description
Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-05-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Chrome’s SanitizerAPI allows a remote attacker to embed malicious scripts or HTML into a crafted page, leading to arbitrary code execution within the browser. This cross‑site scripting weakness (CWE-79) can be used to steal data, hijack sessions, or modify page content, compromising the confidentiality and integrity of the user's browsing session.

Affected Systems

Google’s Chrome browser versions up to and including 148.0.7778.95 are affected. Users should upgrade to 148.0.7778.96 or later to obtain the fix.

Risk and Exploitability

The vulnerability has a CVSS score of 5.4, indicating medium severity, and can be triggered by any user who visits a malicious page crafted by an attacker. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit it remotely through a standard web request.

Generated by OpenCVE AI on May 6, 2026 at 23:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 148.0.7778.96 or later.
  • Enable Chrome’s Site Isolation and Safe Browsing protections in the settings.
  • If an update cannot be applied immediately, restrict JavaScript execution for untrusted sites using extensions such as NoScript or equivalent.

Generated by OpenCVE AI on May 6, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6250-1 chromium security update
History

Thu, 07 May 2026 00:15:00 +0000

Type Values Removed Values Added
Title SanitizerAPI Remote Script Injection via Crafted HTML in Chrome

Wed, 06 May 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Wed, 06 May 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 06 May 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Wed, 06 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 06 May 2026 20:15:00 +0000

Type Values Removed Values Added
Title SanitizerAPI Remote Script Injection via Crafted HTML in Chrome
Weaknesses CWE-79

Wed, 06 May 2026 18:30:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-06T21:58:23.432Z

Reserved: 2026-05-05T22:59:15.089Z

Link: CVE-2026-7939

cve-icon Vulnrichment

Updated: 2026-05-06T20:51:33.432Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-06T19:16:42.237

Modified: 2026-05-06T23:33:57.270

Link: CVE-2026-7939

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T00:00:13Z

Weaknesses