CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

dref

DNS Rebinding Exploitation Framework This project is no longer maintained. dref does the heavy-lifting for DNS rebinding. The following snippet from one of its built-in payloads shows the framework being used to scan a local subnet from a hooked browser; after identifying live web services it...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — обход Same-Origin Policy через межпортовый перехват CVE-2026-20643 | ---|--- CVE| CVE-2026-20643 Обнаружено| Thomas Espach WebKit Bugzilla 306050 Компонент| WebKit — WebCore::Navigation::innerDispatchNavigateEvent Затронуто| iOS 26.3.1 build...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1...

whonow

Serveur DNS Whonow Un serveur DNS malveillant pour exécuter des attaques de rebinding DNS à la volée. whonow vous permet de spécifier dynamiquement les réponses DNS et les règles de rebinding en utilisant les requêtes de domaine elles-mêmes. respond to DNS queries for this domain with 34.192.228....

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

flash-xdomain-xploit

Автор: Gursev Singh Kalra [email protected] Обход политики Same Origin Policy с помощью Flash и небезопасного crossdomain.xml Компиляция и развертывание Proof of Concept кода на ActionScript 1. Загрузите и установите Apache Flex SDK. В его состав входит компилятор ActionScript. 2. Скопируйте...

flash-xdomain-xploit

Автор: Gursev Singh Kalra [email protected] Обход Same Origin Policy с помощью Flash и небезопасного crossdomain.xml Компиляция и развертывание ActionScript-кода Proof of Concept 1. Скачайте и установите Apache Flex SDK. В его состав входит компилятор ActionScript. 2. Скопируйте...

LavaDome

LavaDome 🌋️ Новый инструментLavaMoat для DOM -узлов с защищённой E нкапсуляцией ⚠️ ЭКСПЕРИМЕНТАЛЬНО WIP - ИСПОЛЬЗУЙТЕ НА СВОЙ РИСК подробнее Демо ПопробуйтеLavaDome - посетите демо-приложение, откройте консоль и сделайте всё возможное, чтобы украсть секрет из экземпляра LavaDome сообщите о своём...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — Универсальный XSS UXSS в UC Browser для Android Материалы PoC для CVE-2026-78997 — универсальный межсайтовый скриптинг в UC Browser для Android com.UCMobile.intl, версия 13.7.8.1314, раскрытый Omri Inbar Novee. Отражённый XSS на домене mtmsg.uc.cn, внесённом в белый список моста,...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

EUVD-2026-90973

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922

The Capacitor cross-platform native runtime (versions 6.0.0 up to 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1) contains a navigation guard vulnerability on Android and iOS . The guard validates the host and scheme of a target URL but fails to validate the path , allowing an attacker to navigate a frame...

CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — srcdoc-данные на URI, отличном от about:srcdoc UXSS в Firefox Proof of concept: скомпрометированный контентный процесс подделывает загрузку PDocumentChannel, чей nsDocShellLoadState содержит SrcdocData вместе с произвольным URI. Уязвимые сборки отдают HTML атакующего как документ...

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

SummaryAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, an...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_14442)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514442 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14844)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514844 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape du...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_9692)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20269692 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43213 webkitgtk: Processing maliciously crafted web...