CVE-2026-52842

Published: Jul 15, 2026Modified: Oct 24, 2026Deferred

9.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.8

Source: security-advisories@github.com (Secondary)

Description

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.

Related CWEs

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (4)

https://github.com/lightpanda-io/browser/commit/0588cc374d4af9687cf6f45a7d52f7af04bbacfb

Source: security-advisories@github.com

https://github.com/lightpanda-io/browser/pull/1998

Source: security-advisories@github.com

https://github.com/lightpanda-io/browser/releases/tag/0.3.1

Source: security-advisories@github.com

https://github.com/lightpanda-io/browser/security/advisories/GHSA-mq6p-m9cc-q432

Source: security-advisories@github.com

Timeline

No history available yet.