CVE-2026-14145: Google Chrome CSS Injection UXSS Vulnerability (v150.0.7871.47)

Technical summary

The vulnerability stems from an inappropriate implementation in Chrome's CSS handling mechanism that fails to properly sanitize or validate certain style-related inputs. This permits a Universal XSS (UXSS) condition where arbitrary JavaScript or HTML can be injected and executed in a context that crosses security boundaries—typically allowing script execution in a more privileged or broader scope than a standard reflected XSS. The attack vector is network-based with low attack complexity; it requires user interaction (clicking a link or visiting a malicious site) but no special privileges. The CVSS 3.1 score of 6.1 (Medium severity) reflects low confidentiality and integrity impact with no availability impact, constrained by the requirement for user interaction.

Business impact

Users running unpatched Chrome versions face elevated risk of session hijacking, credential theft, and malware infection when visiting adversarial websites. Organizations deploying Chrome across endpoints should prioritize patching to prevent attackers from stealing sensitive data or planting persistent backdoors. The broader attack surface—since UXSS can transcend normal origin restrictions—means a single compromised webpage could potentially affect users across multiple trust boundaries if Chrome processes them within the same security context.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all Chrome installations on Windows, macOS, and Linux that have not been updated to 150.0.7871.47 or later. Users on older versions or with auto-update disabled remain vulnerable. Chromebook devices running Chrome OS prior to the patched version are similarly affected.

Exploitability

Exploitability is straightforward in practice. An attacker creates a malicious HTML page containing CSS designed to trigger the injection vulnerability and hosts it on the internet or embeds it in a phishing email. When a user visits the page (via social engineering, malvertising, or email link), the CSS flaw allows script injection without additional user actions beyond the initial visit. No authentication, special network access, or system privileges are required. The vulnerability does not currently appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited evidence of active, weaponized exploitation in the wild at the time of disclosure, though this may change.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome typically auto-updates; verify your installed version by navigating to chrome://settings/help and confirming the version matches the patched release. Organizations should enforce automated updates across managed devices or deploy the patched version through their systems management tools. No workarounds exist; patching is the only effective mitigation.

Patch guidance

Deploy Chrome 150.0.7871.47 or newer across all endpoints. For enterprise environments, verify deployment through Chrome Management Console or your MDM/EMM solution. Users can manually check for updates via chrome://settings/help, which will prompt an automatic update if one is available. After updating, restart Chrome to ensure the patch is applied. Verify patching completion within one week of availability.

Detection guidance

Monitor Chrome version compliance across your environment using endpoint detection tools or inventory management systems. Web proxies and intrusion detection systems may flag suspicious CSS patterns, though signatures for this specific vulnerability may be limited. Consider deploying YARA rules or SNORT/Suricata rules targeting malicious CSS injection payloads if available from threat intelligence feeds. Log requests to known malicious sites and monitor for users visiting high-risk domains. User reports of unexpected script behavior or session resets should be investigated as potential exploitation attempts.

Why prioritize this

Although the Chromium security team classified this as Low severity and CVSS 6.1 is Medium, the attack surface is broad—every Chrome user is a potential target—and requires only user interaction to exploit. UXSS vulnerabilities are particularly concerning because they cross normal security boundaries. Given Chrome's ubiquity in enterprise and consumer environments, the ease of exploitation, and the potential for data theft or malware deployment, this warrants high-priority patching even at CVSS 6.1. The lack of KEV listing suggests active exploitation is not yet widespread, providing a window to patch before threats emerge.

Risk score, explained

CVSS 6.1 (Medium) reflects the attack vector (network, unauthenticated), low attack complexity, and the requirement for user interaction. The impact is limited to low confidentiality and integrity (not availability), and scope is changed, meaning the vulnerability affects resources beyond the vulnerable component. While not critical, the broad user base, ease of exploitation, and XSS nature elevate operational risk above the base CVSS score alone.

Frequently asked questions