CVE-2026-52843

{
  "id": "CVE-2026-52843",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T17:16:50.467",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9."
    },
    {
      "lang": "es",
      "value": "Lightpanda es un navegador sin interfaz gráfica diseñado para IA y automatización. Antes de la 0.2.9, fetch() y XMLHttpRequest de Lightpanda adjuntaban incondicionalmente cookies de sesión a cada solicitud HTTP, ignorando credentials: omit, credentials: same-origin, credentials: include, y XMLHttpRequest.withCredentials, permitiendo que un origen controlado por un atacante en una sesión de Lightpanda emitiera solicitudes autenticadas de origen cruzado contra un origen víctima. Este problema se ha corregido en la versión 0.2.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "lightpanda-io",
          "product": "browser",
          "versions": [
            {
              "version": "< 0.2.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T17:37:05.863200Z",
          "id": "CVE-2026-52843",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/lightpanda-io/browser/pull/2155",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc",
      "source": "[email protected]"
    }
  ]
}