CVE-2025-69771

9.6 criticalEPSS 0.4%

Critical (9.6) in killergerbah asbplayer. EPSS 0.4% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the same-site context, it can bypass cross-origin restrictions, leading to unauthorized same-site API requests and session data exfiltration.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-02-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

killergerbah:asbplayer

References

https://github.com/killergerbah/asbplayer
https://reve-offensive.tistory.com/35

Check your stack JSON