CVE-2026-40451

CVE-2026-40451 is a cross-site scripting (XSS) vulnerability affecting DeepL Chrome browser extension versions 1.22.0 through 1.23.0. The flaw allows attackers to execute arbitrary JavaScript code within a user's browser and inject malicious HTML into webpages viewed by the affected user. This vulnerability poses a risk to any user of the DeepL extension within the affected version range. The vulnerability has a CVSS 3.0 score of 6.1 (medium severity) with a network-based attack vector requiring minimal complexity and user interaction to exploit, though no special privileges are needed. The attack scope is changed, meaning it can affect resources beyond the vulnerable component, with limited impacts to confidentiality and integrity but no availability impact. The Faucet Risk Score of 43.0/100 indicates a moderate threat level. Currently, this vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on public hot lists, suggesting no active exploitation in the wild at this time. The extremely low EPSS score of 0.00031 indicates minimal likelihood of near-term exploitation compared to other CVEs. However, organizations should still prioritize patching to versions above 1.23.0 to eliminate this XSS attack surface.