Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass the same-origin policy through malicious network traffic. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, and watchOS 9.6. A website may be able to bypass the Same Origin Policy...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass the same-origin policy through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

A violation of the same-origin policy could have allowed the theft of cross-origin URL entries, leading to the leakage of the results of a redirect, through the use of performance.getEntries. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...

CVE-2026-43735

CVE-2026-43735 WebKit 跨域信息泄露。Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null 原理 父页用 触发跨域 iframe 的片段导航时，iframe 收到的 NavigateEvent.sourceElement 是父页那个 元素，sourceElement.ownerDocument 就是父页的整个 Document。于是跨域 iframe 能读（querySelector....textContent）、能改（改 DOM / 改表单 action）、甚至注入 在父域执行...

CVE-2026-87447

A flaw was found in the Network component of Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could potentially gain...

CVE-2026-87442

A flaw was found in Prerender in Google Chrome. A remote attacker who has compromised the renderer process could exploit a confused deputy vulnerability by crafting a malicious HTML page. This could potentially allow them to bypass the web origin policy, which is a fundamental security mechanism...

CVE-2026-87436

A flaw was found in Chromium. A remote attacker, leveraging social engineering, could exploit an incomplete cleanup vulnerability in the browser. This could allow the attacker to bypass the web origin policy through a specially crafted extension, potentially leading to unauthorized access to...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

CVE-2026-87434

A flaw was found in Chromium, affecting Google Chrome. A remote attacker, having compromised the renderer process, could exploit missing authorization in Cross-Origin Resource Sharing CORS to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page,...

CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87449

A flaw was found in Google Chrome. This cross-site request forgery CSRF vulnerability, which tricks a web browser into executing an unwanted action on a trusted site where the user is authenticated, specifically affects the DeviceBoundSessionCredentials feature. A remote attacker can exploit this...

CVE-2026-87466

A flaw was found in Chromium. Incorrect authorization within the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actio...

CVE-2026-87561

A flaw was found in chromium-browser. A remote attacker could exploit incorrect authorization in Web Authentication by using a specially crafted Chrome extension. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized access or information disclosure...