Advisories · Technology

lightpanda-io browser.

Every CVE that names lightpanda-io browser among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-52842 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass
- lightpanda-io browser
- CWE-346
Not analysed yet 15 Jul 2026
CVE-2026-52843 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode
- lightpanda-io browser
- CWE-346
Not analysed yet 15 Jul 2026