5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48883

CVE-2025-48883: Chrome PHP is missing encoding in `CssSelector`

Impact

CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities.

Patches

This is patched in v1.14.0.

Workarounds

Users can apply encoding manually to their selectors, if they are unable to upgrade.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48883

CVE-2025-48883:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chrome-php/chrome	composer	< 1.14.0	1.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the CssSelector class within the chrome-php/chrome library, specifically in how CSS selector expressions provided by the user were handled. The commit 34b2b8d1691f4e3940b1e1e95d388fffe81169c8 clearly shows the fix.

Before the patch:

The __construct method stored the raw CSS selector expression.
The expressionCount and expressionFindOne methods directly interpolated this raw expression into JavaScript code strings using sprintf with "%s".

This direct interpolation without proper encoding or sanitization meant that a crafted CSS selector containing special characters (e.g., ", </script>) could break out of the intended JavaScript string and inject arbitrary JavaScript code, leading to a Cross-Site Scripting (XSS) vulnerability.

The patch addresses this by encoding the expression using json_encode with appropriate flags (JSON_UNESCAPED_SLASHES, JSON_UNESCAPED_UNICODE, JSON_THROW_ON_ERROR) in the constructor. The methods expressionCount and expressionFindOne then use this pre-encoded expression, ensuring that any special characters are safely escaped before being embedded in the JavaScript context. The vulnerable functions are those that handled or used the unencoded expression: the constructor where it was stored, and the two methods that used it to generate JavaScript.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48883: Chrome PHP is missing encoding in `CssSelector`

Impact

Patches

Workarounds

CVE-2025-48883:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2025-48883: Chrome PHP is missing encoding in `CssSelector`

Impact

Patches

Workarounds

Basic Information

Basic Information

5.3

5.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI