1077 matches found
mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)
mcp-chrome-bridge =1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server. id: CVE-2026-102878 info: name: mcp-chrome-bridge hangwin/mcp-chrome = 1.0.31 - CORS Origin Bypass CSWSH author:...
CVE-2026-43700
CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...
GHSA-47HV-J4PX-H3C9 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...
CVE-2026-113128
A flaw was found in chromium-browser. Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy by convincing a victim to visit a crafted HTML page. Successful exploitation could lead to information disclosure by allowing an unauthorized website to...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – vulnerability in Chromium
Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – vulnerability in Chromium
Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Improper input validation in the Preload feature of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Apache2
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...
Astra Linux – vulnerability in Chromium
A information leak in the DOM within Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies by using a specially crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Missing authorization in the Preload feature of Google Chrome before version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
The race condition in Autofill in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: High...
CVE-2026-106331
An improper input validation flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553256068...
EUVD-2026-93593
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106359
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106196
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...
PT-2026-106871
Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 155.0.8059.39 Description Missing authorization in Navigation allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin c...
CVE-2026-106331: Improper Input Validation
Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. Chromium security severity: Low...