CVE-2026-13836: Google Chrome UXSS via CSS Injection – Patch to 150.0.7871.47

Technical summary

A flaw in Chrome's CSS implementation fails to properly validate or sanitize crafted stylesheet content, allowing attackers to break out of intended CSS parsing constraints and inject arbitrary JavaScript or HTML. The vulnerability is triggered via user interaction (visiting a malicious page) and does not require authentication or special browser configuration. The attack leverages the browser's rendering engine to interpret attacker-controlled content as executable code rather than presentation instructions. This maps to CWE-79 (Cross-site Scripting), though the UXSS variant is more dangerous than typical DOM-based XSS.

Business impact

If your workforce uses Chrome and encounters a phishing email or malicious advertisement linking to an exploit page, an attacker could steal session cookies, harvest credentials, deface content, or redirect users to credential-harvesting sites—all appearing to originate from trusted domains. For organizations relying on web applications with strict same-origin policies, UXSS bypasses those protections entirely. The attack doesn't require a vulnerable backend; it exploits the browser itself. Affected users may lose confidence in browser security if they notice suspicious activity on familiar websites.

Affected systems

Google Chrome prior to version 150.0.7871.47 on all operating systems (Windows, macOS, Linux) is vulnerable. Users with automatic updates enabled may already be protected; those on manual update cycles or air-gapped environments remain at risk. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) using unpatched Chromium code from before the fix may also be vulnerable; verify vendor advisories for those products.

Exploitability

Exploitability is straightforward: an attacker crafts an HTML page with malicious CSS, hosts it on a server they control, and distributes the URL via email, ads, or forum posts. The victim must click the link and view the page—no zero-click variant is described. The attack requires no special network position or browser extensions. However, an alert user might notice unusual behavior (unexpected popups, redirects) and close the tab. The CVSS score reflects this: a network vector, low attack complexity, and required user interaction (clicking a link) yield a MEDIUM severity rating, but the impact (credential theft, session hijacking) is significant in practice.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. On Windows and macOS, use Settings > About Chrome to force a check for updates and automatic restart. On Linux, update via your package manager or download the latest version from google.com/chrome. For organizations, use group policy (Windows) or MDM solutions to enforce auto-update or push the patched version to all devices. Verify the update completed by visiting chrome://version/ and confirming the version number matches or exceeds the fix.

Patch guidance

Google released the fix in Chrome 150.0.7871.47. No interim mitigations (disable CSS, disable JavaScript) are practical for everyday browsing. Prioritize deployment immediately, as exploitation is trivial once an attacker publishes or shares a crafted page. If you manage devices that are not yet on 150.0.7871.47, schedule an update cycle within the next 48 hours. Verify patched versions in your fleet before closing your remediation ticket.

Detection guidance

Look for users accessing unfamiliar or suspicious URLs in proxy logs, especially shortened links or misspelled domain names. Monitor browser process logs for unusual CSS file loads from unexpected origins. Intrusion detection systems may flag signs of credential theft (unusual login locations, rapid authentication failures) if UXSS is exploited. Conduct user awareness training to recognize phishing emails with suspicious links. Browser telemetry (if enabled) may report crash or render engine errors from malformed CSS in unpatched versions. Most organizations will rely on update confirmation rather than active detection, since the vulnerability is patched quickly.

Why prioritize this

Although CVSS is MEDIUM (6.1), the practical risk is MEDIUM-HIGH. UXSS is a severe class of vulnerability that defeats browser sandbox boundaries; attackers need only a single click from a victim to steal sensitive data or perform actions on their behalf. The low barrier to exploitation (craft a webpage, send a link) means this will be weaponized quickly. Chrome's automatic update mechanism reduces exposure over time, but organizations with manual or staggered updates face active risk. Patch this within 48 hours of confirming it affects your Chrome fleet.

Risk score, explained

The CVSS 3.1 score of 6.1 MEDIUM reflects: (1) Network attack vector (attacker doesn't need local access), (2) Low attack complexity (no special tools or browser state required), (3) No privileges required, (4) Required user interaction (victim must click a link and view the page), (5) Scope changed (can affect confidentiality and integrity of user sessions across multiple sites), and (6) Limited impact (no denial of service, though data theft and defacement are possible). The score underweights the practical severity of UXSS—an attacker defeating same-origin policy is a serious trust violation—but the 'required user interaction' constraint justifies MEDIUM rather than HIGH. For risk prioritization, treat this as HIGH priority despite the CVSS rating.

Frequently asked questions