CVE-2026-76019

A high-severity incorrect authorization vulnerability in Workers affects Google Chrome and Microsoft Edge (Chromium-based) prior to version 151.0.7922.173 . A remote attacker who has compromised the renderer process can leverage social engineering and a crafted HTML page to bypass the web origin ...

CVE-2026-19153 Insufficient validation of untrusted input in Workers

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2015-7147

Malware in sbrugna...

CVE-2015-7215

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure...

Information disclosure

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure...

CVE-2015-7215

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure...

CVE-2015-7215

CVE-2015-7215 affects Mozilla Firefox before 43.0 (and ESR 38.x) via the Web Workers importScripts implementation. The underlying issue is that triggering no-cors fetch via importScripts can bypass the Same Origin Policy, leading to information disclosure after a rethrow. Impact reported across m...

CVE-2015-7215: Exposure of Sensitive Information to an Unauthorized Actor

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure...