Skip to content

lightpanda-io browser

CVE-2026-52842 Critical 9.3 Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass 0.2%
CVE-2026-52843 Critical 9.3 Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode 0.2%