XSS Vulnerability in Chrome PHP Affects Multiple Versions
CVE-2025-48883

5.3MEDIUM

Key Information:

Vendor

Chrome-PHP

Status
Chrome
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48883?

Chrome PHP prior to version 1.14.0 contains a vulnerability that allows attackers to exploit improper encoding of CSS Selector expressions. This can lead to Cross-Site Scripting (XSS) attacks, potentially compromising user data and site integrity. Users are encouraged to upgrade to version 1.14.0 or later to mitigate this risk. Alternatively, if upgrading is not feasible, manually applying encoding to selectors can help prevent exploitation.

Affected Version(s)

chrome < 1.14.0

References

https://github.com/chrome-php/chrome/security/advisories/...
x_refsource_CONFIRM
https://github.com/chrome-php/chrome/pull/691
x_refsource_MISC
https://github.com/chrome-php/chrome/commit/34b2b8d1691f4...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48883 : XSS Vulnerability in Chrome PHP Affects Multiple Versions