firefox: thunderbird: Same-origin policy bypass in the WebExtensions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component...

Payload: Uploaded XML files could execute same-origin JavaScript

Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads accepted by default. Patches Users should upgrade Payload packages to = 3.90.0 o...

NPM: Payload: Uploaded XML files could execute same-origin JavaScript

NPM: Payload: Uploaded XML files could execute same-origin JavaScript vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

GHSA-9QPG-3CF8-W33X Payload: Uploaded XML files could execute same-origin JavaScript

Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads accepted by default. Patches Users should upgrade Payload packages to = 3.90.0 o...

firefox: thunderbird: Same-origin policy bypass in the WebExtensions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component...

firefox: thunderbird: Same-origin policy bypass in the WebExtensions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component...

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

EUVD-2026-90973

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox and Thunderbird

Bypass of the same-origin policy in the DOM: Notification component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox and Thunderbird

A violation of the same-origin policy could have allowed the theft of cross-origin URL entries, leading to the leakage of the results of a redirect, through the use of performance.getEntries. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

tags that referenced a document from the same origin could have allowed script execution if the attacker’s input was sanitized using the HTML Sanitizer API. This would require the attacker to reference a JavaScript file from the same origin that contained the script to be executed. This...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass the same-origin policy through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

A malicious extension with the “search” permission could have installed a new search engine, and the favicon of this engine referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing it to bypass the same-origin policy—even though the...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Opportunistic Encryption feature of HTTP2 RFC 8164 allows a connection to be transparently upgraded to TLS while maintaining the visual properties of an HTTP connection. This means that the connection remains within the same origin as unencrypted connections on port 80. However, if a second...