EUVD-2026-77522
GHSA-cf92-q3x8-658f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, high complexity (cross-origin postMessage setup), user interaction required, scope changes to publisher domain with limited C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.
AnalysisAI
DOM-based cross-site scripting in TripleLift's video-bundle.js ad rendering script allows unauthenticated remote attackers to execute arbitrary JavaScript within a publisher's domain by sending crafted postMessage events without origin validation. The attack requires social engineering a victim into visiting an attacker-controlled page, which then fires malicious postMessage payloads at any publisher page running the TripleLift video ad script. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target publisher page must be actively loading TripleLift's video-bundle.js ad script (pre-April 28, 2026 version); (2) the victim must have both the publisher page and the attacker-controlled page open in the same browser session, or the attacker's page must open/reference the publisher page directly; (3) no authentication to TripleLift or the publisher is required - the vulnerability is in a client-side script executing in the victim's browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 accurately captures the realistic exploitability ceiling: AC:H reflects that the attacker must orchestrate a cross-origin messaging scenario, and UI:P requires the victim to visit the attacker's page, significantly constraining mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A vendor patch is available per advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today