Video Bundle Js
Monthly
DOM-based cross-site scripting in TripleLift's video-bundle.js ad rendering script allows unauthenticated remote attackers to execute arbitrary JavaScript within a publisher's domain by sending crafted postMessage events without origin validation. The attack requires social engineering a victim into visiting an attacker-controlled page, which then fires malicious postMessage payloads at any publisher page running the TripleLift video ad script. Successful exploitation enables session hijacking and unauthorized DOM manipulation in the victim's browser context on the publisher domain. A publicly available proof-of-concept exists; no KEV listing at time of analysis.
DOM-based cross-site scripting in TripleLift's video-bundle.js ad rendering script allows unauthenticated remote attackers to execute arbitrary JavaScript within a publisher's domain by sending crafted postMessage events without origin validation. The attack requires social engineering a victim into visiting an attacker-controlled page, which then fires malicious postMessage payloads at any publisher page running the TripleLift video ad script. Successful exploitation enables session hijacking and unauthorized DOM manipulation in the victim's browser context on the publisher domain. A publicly available proof-of-concept exists; no KEV listing at time of analysis.