What’s Vulnerable › Vulnerabilities

CVE-2026-52842: Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-15 · updated 2026-10-24
• Weakness: CWE-346

Description

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.

Affected products

• lightpanda-io browser: before 0.3.1

References

• https://github.com/lightpanda-io/browser/commit/0588cc374d4af9687cf6f45a7d52f7af04bbacfb
• https://github.com/lightpanda-io/browser/pull/1998
• https://github.com/lightpanda-io/browser/releases/tag/0.3.1
• https://github.com/lightpanda-io/browser/security/advisories/GHSA-mq6p-m9cc-q432

Get alerted when CVE-2026-52842 or the next vulnerability affects your stack