XSS Vulnerability in Chrome PHP's CssSelector - Upgrade Required
Summary
CVE-2025-48883: Chrome PHP is missing encoding in CssSelector. Affects chrome-php/chrome versions < 1.14.0. Fixed in 1.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chrome PHP is a library that allows developers to interact with the Chrome browser using PHP. It provides functionalities for web scraping, automation, and testing. However, a recent vulnerability has been identified in the CssSelector component, which is responsible for parsing and handling CSS selectors. This vulnerability can lead to cross-site scripting (XSS) attacks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from improper encoding of CSS Selector expressions within the Chrome PHP library. This flaw can be exploited by attackers to inject malicious scripts into web pages, potentially compromising user data and application integrity. The issue is classified under CWE-79, which pertains to improper neutralization of input during web page generation, leading to XSS vulnerabilities.
How To Fix
Minimum fixed version
1.14.0
This is the first release that contains the fix.
composer require chrome-php/chrome:1.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can manually apply encoding to their CSS selectors to mitigate the risk. For example, ensure that any user-generated input used in selectors is properly encoded using PHP's htmlspecialchars() function before being processed. Here is a sample code snippet:
$selector = htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
Conclusion
The identified XSS vulnerability in the Chrome PHP library's CssSelector component poses a significant risk to applications using this package. It is crucial for developers to upgrade to the patched version 1.14.0 or implement manual encoding as a temporary measure to safeguard against potential attacks.
See every vulnerability recorded for chrome-php/chrome →
FAQ
The vulnerability is an XSS issue caused by improper encoding of CSS Selector expressions in the Chrome PHP library.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
If exploited, this vulnerability can allow attackers to inject malicious scripts, leading to data theft, session hijacking, or defacement of web pages.
Yes, the vulnerability has been patched in version 1.14.0 of the Chrome PHP package.
If an immediate upgrade is not possible, manually encode your CSS selectors using PHP's htmlspecialchars() function to mitigate the risk.
