Beveiligingsadvies

CVE-2026-82019

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-14 14:10:56

Laatst bijgewerkt 2026-09-14 15:32:00

Toegewezen door VulnCheck

CVSS-score 4.2

Status PUBLISHED

Beschrijving

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.

← Alle CVE's bekijken Bekijk op cve.org ↗