EUVD-2026-44714Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-reachable, low-complexity, no privileges but requires the session to load attacker content (UI:R); abusing one origin against a different victim origin is a scope change with high confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
AnalysisAI
Cross-origin credential leakage in Lightpanda, a headless browser built for AI and automation workloads, occurs because fetch() and XMLHttpRequest attach session cookies to every outbound HTTP request regardless of the caller's requested credentials mode. In versions prior to 0.2.9, the credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials controls are all ignored, so attacker-controlled content running inside a Lightpanda session can silently issue authenticated cross-origin requests against any victim origin whose cookies are present in the session's shared cookie jar. There is no public exploit identified at time of analysis and no CISA KEV listing, but the root-cause code fix is public in PR #2155, and the CVSS base score is 9.3.
Technical ContextAI
The affected component is the browser's Web API networking layer (cpe:2.3:a:lightpanda-io:browser). Lightpanda maintains a single session-scoped cookie jar (page._session.cookie_jar) that its HTTP client consults. The vulnerability is CWE-346 (Origin Validation Error): the request path unconditionally passed a pointer to the session cookie jar into every fetch and XMLHttpRequest, never consulting the request's credentials mode or the same-origin status of the target URL. The fix in Fetch.zig introduces a switch on request._credentials so that omit yields a null cookie jar, include attaches cookies, and same-origin attaches cookies only when page.isSameOrigin(request._url) is true; XMLHttpRequest.zig similarly now gates cookie support on self._with_credentials OR a same-origin check. The supporting change makes isSameOrigin a non-failing boolean, hardening the same-origin comparison that also protects History and Navigator protocol-handler validation.
RemediationAI
Vendor-released patch: 0.2.9 - upgrade Lightpanda to 0.2.9 or later, which enforces credentials mode and same-origin checks before attaching session cookies (see release https://github.com/lightpanda-io/browser/releases/tag/0.2.9 and advisory https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc). Until upgraded, reduce the credential blast radius rather than relying on generic hardening: run automation flows that visit untrusted or attacker-influenced origins in a separate Lightpanda session/instance from any flow that authenticates to sensitive origins, so the shared cookie jar never simultaneously holds sensitive cookies and untrusted content (trade-off: more session orchestration and no shared login state). Where feasible, avoid storing long-lived authenticated cookies in sessions that browse third-party content, and use network egress controls to restrict which victim origins an automation session can reach (trade-off: may break legitimate cross-origin API calls the automation depends on).
A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function han
An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android
Same-Origin Policy bypass in Lightpanda headless browser before 0.3.1 allows an attacker-controlled site to impersonate
Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allo
SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote
Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in T
Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. Rated medium severity
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today