CVE-2025-69771CRITICAL 9.6EPSS p23.8%

CVE-2025-69771CVE-2025-69771

Description

Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the same-site context, it can bypass cross-origin restrictions, leading to unauthorized same-site API requests and session data exfiltration.

Scoring

CVSS 3.19.6 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS0.32% probability of exploitation · percentile 23.8% · 2026-06-19T12:03:05Z
Published2026-02-25
Last modified2026-03-20

Underlying weaknesses· 1

CWE-434

References

  1. https://github.com/killergerbah/asbplayer
  2. https://reve-offensive.tistory.com/35

1

TypeTargetConfidenceTier
WeaknessUnrestricted Upload of File with Dangerous Typecwe-4340%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-9866
CVE
CVE-2026-11259
CVE
CVE-2026-11181
CVE
CVE-2026-11301
CVE
CVE-2026-11069
CVE
CVE-2026-9989
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.