GHSA-3432-fmrf-7vmhMedium

Chrome PHP is missing encoding in `CssSelector`

Published
May 28, 2025
Last Modified
May 30, 2025

🔗 CVE IDs covered (1)

CVE-2025-48883 →

📋 Description

Impact

CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities.

Patches

This is patched in v1.14.0.

Workarounds

Users can apply encoding manually to their selectors, if they are unable to upgrade.

🎯 Affected products1

  • composer/chrome-php/chrome:< 1.14.0

🔗 References (5)