CVE-2025-48883 - Chrome PHP is missing encoding in `CssSelector`

Back Back to CVE browser

MEDIUM

Chrome PHP is missing encoding in `CssSelector`

Published May 30, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding manually to their selectors if they are unable to upgrade.

Affected products

Vendor Chrome-PHP Product Chrome Default
n/a
- Version
  < 1.14.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Chrome-PHP

Chrome

n/a

Version	Status	Constraints
< 1.14.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16516
Advisory
https://github.com/advisories/GHSA-3432-fmrf-7vmh
Advisory
https://github.com/chrome-php/chrome/commit/34b2b8d1691f4e3940b1e1e95d388fffe81169c8
x_refsource_MISC
https://github.com/chrome-php/chrome/pull/691
x_refsource_MISC
https://github.com/chrome-php/chrome/security/advisories/GHSA-3432-fmrf-7vmh
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2025-48883

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16516		Advisory
https://github.com/advisories/GHSA-3432-fmrf-7vmh		Advisory
https://github.com/chrome-php/chrome/commit/34b2b8d1691f4e3940b1e1e95d388fffe81169c8		x_refsource_MISC
https://github.com/chrome-php/chrome/pull/691		x_refsource_MISC
https://github.com/chrome-php/chrome/security/advisories/GHSA-3432-fmrf-7vmh		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2025-48883