CVE-2026-40451 is a cross-site scripting vulnerability affecting DeepL's Chrome browser extension versions 1.22.0 to 1.23.0. The flaw enables an attacker to execute arbitrary JavaScript code within the user's browser session and inject malicious HTML content into web pages. This could potentially lead to information disclosure or manipulation of web content as rendered to the user. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.0 base score is 6.1, reflecting medium impact on confidentiality and integrity but no impact on availability. No official remediation or patch has been documented as of the published date.

Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser context and inject malicious HTML into web pages, potentially leading to partial compromise of user data confidentiality and integrity. There is no reported impact on system availability. The vulnerability requires user interaction to trigger and does not require privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or uninstalling the affected DeepL Chrome extension versions 1.22.0 to 1.23.0 to prevent exploitation. Monitor official DeepL communications for updates on patches or mitigations.