CVE-2026-14147
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile — higher than 6% of all known CVEs
Summary
An inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. The issue is rated as low severity.
Risk Assessment
An attacker could exploit this vulnerability to perform a Universal XSS attack, potentially leading to session data theft, page content manipulation, or unauthorized actions in the context of other websites.
Recommendation
Update Google Chrome to version 150.0.7871.47 or later immediately. It is also recommended to enable automatic updates for all users.
Original NVD description (English source)
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)