CVE-2025-48883 Details
Description
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding manually to their selectors if they are unable to upgrade.
A cross-site scripting vulnerability has been identified in Chrome PHP versions prior to 1.14.0. The issue arises because CSS Selector expressions are not properly encoded, allowing for potential JavaScript injection. This vulnerability can be exploited by manipulating selector inputs in a way that introduces unescaped characters, leading to the execution of malicious scripts.
Users can upgrade to Chrome PHP version 1.14.0 or later, where this vulnerability has been patched. Alternatively, selectors can be manually encoded before use, applying a JSON encoding to ensure proper formatting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 30, 2025CISA-ADP
Assessed May 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chrome-php/chrome/commit/34b2b8d1691f4e3940b1e1e95d388fffe81169c8 | [email protected] | Source CodeVendor |
| https://github.com/chrome-php/chrome/pull/691 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/chrome-php/chrome/security/advisories/GHSA-3432-fmrf-7vmh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chrome-php/chrome | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 30, 2025 | New CVE Received | [email protected] |