CVE-2026-100809

A Same-origin policy bypass exists in the DevTools component of the Firefox web browser. This vulnerability allows for the circumvention of standard security boundaries within the DevTools environment. The issue has been resolved in Firefox ESR 153.4 and Firefox 157 . No specific exploit details ...

CVE-2026-100803

A Same-origin policy (SOP) bypass vulnerability exists in the WebExtensions component of the Firefox browser. This flaw allows for the circumvention of standard security boundaries intended to isolate web content. The issue has been addressed in several versions, including Firefox ESR 153.4 , Fir...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...

CVE-2026-87517

A flaw was found in Google Chrome on iOS. A race condition in the mobile browser component allows a remote attacker to bypass the same-origin policy by tricking a user into opening a specially crafted HTML page. Successful exploitation enables unauthorized access to sensitive cross-origin web dat...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incomplete cleanup in the Browser of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policy through a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

CVE-2026-78947

A flaw was found in Chromium, a component of Google Chrome. This vulnerability, caused by incomplete cleanup, allows a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could gain unauthorized access to sensitiv...

CVE-2026-79152

A flaw was found in Google Chrome CustomTabs. A local attacker could exploit incorrect authorization to bypass the web origin policy through a co-installed application. This bypass could allow unauthorized access to web content...

CVE-2026-79006

A flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security restrictions designed to isolate content from different...

CVE-2026-87608

A flaw was found in Chromium's Federated Credential Management FedCM component. A remote attacker, leveraging social engineering, could exploit improper certificate validation by sending crafted network traffic. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-87551

A flaw was found in chromium-browser. This vulnerability involves improper certificate validation within the Cross-Origin Resource Sharing CORS mechanism. A remote attacker, by leveraging social engineering tactics and crafted network traffic, could bypass the web origin policy. This could lead t...

CVE-2026-87571

A flaw was found in Google Chrome. Improper certificate validation in the Loader component allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. This bypass could enable an attacker to circumvent security restrictions designed to isolat...

CVE-2026-87469

A flaw was found in Extensions in Google Chrome. Improper input validation allows a remote attacker to bypass the web origin policy. This can lead to unauthorized access to privileged pages through specially crafted network traffic...

CVE-2026-87577

A flaw was found in Chromium. A remote attacker could exploit an authorization vulnerability by creating a specially designed web page. This could allow the attacker to bypass security restrictions, known as the web origin policy, and access sensitive information or functionality on a privileged...

CVE-2026-87550

A flaw was found in Google Chrome. A remote attacker could exploit improper encoding or escaping of output within the browser's Cascading Style Sheets CSS component. By delivering a specially crafted HTML page, the attacker could potentially bypass the web origin policy. This policy is a critical...

CVE-2026-79261

A flaw was found in Google Chrome. A remote attacker could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized access to sensitive data or actions within the user's...

CVE-2026-79251

A flaw was found in Google Chrome. Improper input validation in the Network component allows a remote attacker to potentially bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page. The web origin policy is a critical security mechanism that...