IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-05-30 19:15

MODIFIED

2025-06-02 17:32

EPSS (Prob. Exploit)

0.45%

Top 61.6%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-01

> DESCRIPTION

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding manually to their selectors if they are unable to upgrade.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-3432-fmrf-7vmh MODERATE

Chrome PHP is missing encoding in `CssSelector`

AFFECTED PACKAGES:

COMPOSER / chrome-php/chrome

< 1.14.0

Fixed in: 1.14.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Chrome PHP is missing encoding in `CssSelector`

AFFECTED PACKAGES:

Unknown / Unknown

36 versions affected

ALIASES:

GHSA-3432-fmrf-7vmh

> HISTORIQUE DES MODIFICATIONS

Première apparition

30/05/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:04

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui