CVE-2026-113800

A flaw was found in Electron. When evaluating Human Interface Device HID and Universal Serial Bus USB permission requests initiated from an embedded frame iframe, Electron incorrectly passes the top-level page's origin and details to the permission handler instead of the requesting frame's. An...

mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)

mcp-chrome-bridge =1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server. id: CVE-2026-102878 info: name: mcp-chrome-bridge hangwin/mcp-chrome = 1.0.31 - CORS Origin Bypass CSWSH author:...

CVE-2026-34157

The Wails framework (v2.0.0 through v2.13.0) contains a vulnerability where the wildcardPatternToRegex function in v2/internal/frontend/originvalidator/originValidator.go allows an Origin bypass . The root cause is that the function converts a wildcard * into .* without anchoring subcomponents, m...

EUVD-2026-116368

Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

Astra Linux – vulnerability in Chromium

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

GHSA-47HV-J4PX-H3C9 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

CVE-2026-113128

A flaw was found in chromium-browser. Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy by convincing a victim to visit a crafted HTML page. Successful exploitation could lead to information disclosure by allowing an unauthorized website to...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...

CVE-2026-106331

An improper input validation flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553256068...

EUVD-2026-93593

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106359

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106196

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106871

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 155.0.8059.39 Description Missing authorization in Navigation allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin c...

CVE-2026-106331: Improper Input Validation

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-95374

An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543464436...

CVE-2026-102878

The mcp-chrome-bridge software, in versions through 1.0.31 , contains an origin validation error within its native-server HTTP API. This vulnerability allows an attacker to bypass CORS restrictions by crafting malicious web pages. Successful exploitation enables the execution of browser automatio...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...