Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

chrome-php/chrome

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PackagistPublished

    Chrome PHP is missing encoding in CssSelector

    CVE-2025-48883 · GHSA-3432-fmrf-7vmh

    Affected
    • Packagist chrome-php/chrome < 1.14.0
    Fixed in
    1.14.0· Vendor fix available
    Issue
    Impact CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. Patches This is patched in v1.14.0. Workarounds Users can apply encoding manually to their selectors, if they are unable to upgrade.

    Recommended action: Upgrade to 1.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →