CVE-2026-52843criticalCWE-346

CVE-2026-52843: falha crítica em lightpanda-io browser

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode

Publicada em

Seguir esta CVE+ Monitorar browser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.2%
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
lightpanda-io · browser
CVEs relacionadas — lightpanda-io browser

No mesmo produto, das mais perigosas para as menos.

CVE-2026-52842CRITICALLightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypassEPSS 0.2%