EUVD-2026-109817
GHSA-4fqf-wxmc-2q69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Kameleo ListCookies endpoint remotely
-
ExploitManipulate 'guid' argument in request
-
ExecutionTrigger passive user interaction
-
ImpactReceive disclosed cookie data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the CookieController.ListCookies function in client-engine-application/w.cs of Kameleo up to and including version 5.3.1, by manipulating the 'guid' argument to obtain cookie information (CWE-200). The attack is remote and needs no privileges, but the CVSS vector sets UI:P - passive user interaction is required, so exploitation depends on a user action/session rather than being fully autonomous. Impact is limited to low confidentiality (VC:L) with no integrity or availability effect, and no fixed version is identified in the available sources. The precise trigger mechanism beyond manipulating 'guid' is not described in the available sources. |
| Impact | This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.3) in Kameleo's Cookie Controller, and the signals point to a modest, not urgent, real-world priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) indicates a network-reachable, low-complexity issue requiring no privileges but passive user interaction (UI:P), with only low confidentiality impact and no integrity or availability impact - consistent with CWE-200 disclosure of cookie data via manipulation of the 'guid' argument. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the limited impact. No EPSS score and no KEV listing are present in the input, so there is no evidence of active exploitation or a high predicted exploitation probability; exploitation status is therefore 'no public exploit identified at time of analysis' in the KEV sense, though a public PoC reference (a Google Drive link) is attached - it is not verified as working exploit code, so POC availability must not be conflated with active exploitation. The data is single-sourced (VulDB) and the vendor did not respond to disclosure, so there is no independent vendor confirmation of affected versions or impact. Net: a legitimate but lower-tier issue - real enough to patch on a normal cycle, not a high-CVSS-but-overhyped item nor an emergency. |
| Exploit ScenarioDerived | A remote attacker induces a user of a Kameleo instance (up to 5.3.1) to trigger a request to the CookieController.ListCookies function while manipulating the 'guid' argument, causing the application to return cookie information the attacker should not receive. A public PoC reference exists (a Google Drive link); it is not verified as working exploit code. The CVSS vector's low attack complexity and passive user-interaction requirement (UI:P) mean the attack is technically simple but depends on that interaction occurring. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Information disclosure in Kameleo up to and including 5.3.1 allows remote attackers to read cookie data held by the client engine by manipulating the 'guid' argument passed to CookieController.ListCookies in client-engine-application/w.cs. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates no privileges are needed and the attack is network-reachable, but exploitation depends on passive user interaction, and impact is confined to low confidentiality with no integrity or availability effect. No vendor patch or fixed version is identified - the vendor was contacted and did not respond - and there is no CISA KEV entry or confirmed public exploit code; the references include an external Google Drive link whose contents are not characterized in the available data.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis, and the vendor did not respond to the disclosure, so there is no upgrade target to cite; operators should treat any Kameleo deployment at or below 5.3.1 as unpatched and verify independently with the vendor before relying on a later build. Until a fix is confirmed, the most direct compensating control is to constrain reachability of the client engine service - bind it to localhost or an isolated management network and block the port from untrusted segments at the host firewall - accepting that this breaks remote or multi-host automation that depends on the engine's network interface. Where remote access is genuinely required, front the engine with an authenticating reverse proxy or VPN so that requests to the cookie-listing path cannot be issued anonymously, at the cost of additional infrastructure and session-management overhead. Because the assessed vector requires passive user interaction and the disclosed data is cookie material, reduce blast radius by keeping high-value authenticated sessions out of Kameleo-managed profiles, shortening cookie and session lifetimes on the accounts those profiles reach, and monitoring engine logs for cookie-enumeration requests carrying unexpected or foreign 'guid' values. The advisory at https://vuldb.com/vuln/426307 should be tracked for a corrected release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kameleo is a commercial anti-detect browser platform used to run multiple isolated browser profiles with spoofed fingerprints, and its client-engine-application component (written in C#, file w.cs) exposes the profile-handling logic behind that capability. The flaw sits in the Cookie Controller, specifically CookieController.ListCookies, where the 'guid' argument that selects which profile's cookie store to enumerate is not adequately constrained, so a crafted value yields cookie material belonging to another profile - a classic CWE-200 exposure of sensitive information through a lookup keyed on a user-supplied identifier. Because the affected data is cookie material, an attacker who obtains it could in principle reach authenticated sessions held inside the browser profiles that Kameleo manages, which is why the confidentiality impact is scoped to low rather than none. The available sources do not describe how the request is triggered beyond manipulation of 'guid', nor do they confirm whether the client engine is bound to localhost, an authenticated API, or a network-reachable service; the assessed vector only establishes that the attack path is remote, unprivileged, and gated on passive user interaction.
Know when Kameleo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable with no privileges but requires user interaction (UI:R, mapping the 4.0 UI:P); only cookie data is disclosed, so C:L with I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in Kameleo through version 5.3.1 lets an unauthenticated remote attacker read data exposed by the
Information disclosure in the Local API of Kameleo (versions up to and including 5.0.1.26) lets a remote, unauthenticate
Server-side request forgery in Kameleo's proxy-validation feature affects versions up to and including 5.0.1.26 and lets
Kameleo through 5.0.1.26 can disclose profile information to a local, low-privileged user through the Profile Controller
Exploit-DB