What is CVE-2025-48883?

CVE-2025-48883 is a vulnerability in Chrome-Php Chrome, classified under Cross-site Scripting. Published 2025-05-30.

Is CVE-2025-48883 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Chrome-Php Chrome

CVE-2025-48883

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding manually to their selectors if they are unable to upgrade.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (33.1th percentile) — read the EPSS interpretation.

Affected products

Chrome-php Chrome — versions < 1.14.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-48883?: CVE-2025-48883 is a vulnerability in Chrome-Php Chrome, classified under Cross-site Scripting. Published 2025-05-30.
Is CVE-2025-48883 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.