Security Advisory

CVE-2026-82019

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-14 14:10:56

Last updated 2026-09-14 15:32:00

Assigner VulnCheck

CVSS score 4.2

State PUBLISHED

Description

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.

← Browse all CVEs View on cve.org ↗