CVE-2026-52842 Details
Description
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.
A critical Same-Origin Policy bypass vulnerability has been identified in Lightpanda versions prior to 0.3.1. The issue arises because the URL parser incorrectly searches for '@' characters across the entire URL, rather than just the authority component. This flaw allows an attacker to craft a URL that is fetched from their own domain but is treated as originating from a different, victim domain. As a result, the attacker's page can execute with the victim's origin, bypassing security restrictions.
Users can upgrade to Lightpanda version 0.3.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lightpanda-io/browser/commit/0588cc374d4af9687cf6f45a7d52f7af04bbacfb | [email protected] | Source CodeVendor |
| https://github.com/lightpanda-io/browser/pull/1998 | [email protected] | Source CodeVendor |
| https://github.com/lightpanda-io/browser/releases/tag/0.3.1 | [email protected] | Release NotesVendor |
| https://github.com/lightpanda-io/browser/security/advisories/GHSA-mq6p-m9cc-q432 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lightpanda | < 0.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | New CVE Received | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |