CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through <= 1.37.0.
Explanation of Vulnerability in Simple Terms
Google Web Stories versions up to 1.37.0 contain a cross-site scripting vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and can affect other users viewing the same content. An attacker with low privileges can craft a malicious story that executes JavaScript in victims' browsers, potentially stealing session tokens or performing actions on their behalf.
What an attacker can do
Inject JavaScript code that runs in other users' browsers when they view a story.
Potential impact on your site
Users' accounts and data could be compromised if they view stories created by attackers with plugin access.
Conditions required to exploit
Attacker must be logged in with low-level privileges and the victim must view the malicious story.
Key dates
External resources
Related vulnerabilities
