CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87466

A flaw was found in Chromium. Incorrect authorization within the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actio...

CVE-2026-87508

A flaw was found in the Loader component of Google Chrome. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions acro...

CVE-2026-87485

A flaw was found in Google Chrome. This incorrect authorization vulnerability in Cross-Origin Resource Sharing CORS allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This bypass is achieved by crafting a malicious HTML page, potentially...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

NoFrak

NoFrak NoFrak is a Proof of Concept implementation for Android designed to prevent fracking attacks described in "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks", by Martin Georgiev, Suman Jana, and Vitaly Shmatikov. NDSS 2014. Cordova Android Cordova...

CVE-2026-84328

A missing authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498710886 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-79237

An incorrect authorization flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=499068536...

CVE-2026-78942

A flaw was found in the Loader component of Google Chrome. This vulnerability, caused by incorrect reference resolution, allows a remote attacker to bypass the web origin policy by sending specially crafted network traffic. Bypassing the web origin policy can lead to unauthorized access to...

CVE-2026-78946

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the 'Select' component allows a remote attacker to bypass the web origin policy by crafting a malicious HTML page. This could lead to unauthorized access to sensitive information or actions across different web origi...

CVE-2026-78903

A flaw was found in Google Chrome's Site Isolation feature. This vulnerability, caused by an incomplete cleanup process, could allow a remote attacker to bypass site isolation. To exploit this, the attacker must first compromise the browser's renderer process and then use a specially crafted HTML...

CVE-2026-79085

A flaw was found in Chromium's Network component. A remote attacker, after compromising the renderer process, could exploit missing authorization to bypass the web origin policy by crafting a malicious HTML page. This could lead to unauthorized access to sensitive information or actions across...

CVE-2026-79082

A flaw was found in the Transactions Platform of Google Chrome. An attacker who has compromised the renderer process could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow them to bypass the web origin policy, potentially leading to unauthorized...

CVE-2026-79205

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the browser's Network component allows a remote attacker to bypass the web origin policy. By enticing a user to open a specially crafted HTML page, an attacker could potentially gain unauthorized access to sensitive...

CVE-2026-79116

A flaw was found in Viz in Google Chrome. Missing authorization allowed a remote attacker, who had already compromised the renderer process, to bypass the web origin policy. This could be achieved by tricking a user into visiting a specially crafted HTML page, potentially leading to unauthorized...

CVE-2026-79093

A flaw was found in Paint in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to potentially bypass the web origin policy by crafting a malicious HTML page. This could lead to unauthorized access to sensitive information or actions across different web origins...

CVE-2026-62204

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across...

CVE-2026-62204

SiYuan versions before v3.7.4 contain a plugin overwrite vulnerability in the bazaar install endpoints . The root cause is a failure to validate that the packageName parameter matches the actual downloaded package content. An attacker with same-origin access can supply mismatched packageName and ...