By weakness (CWE)

CWE-346: related vulnerabilities

CVEs classified under CWE-346. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

35 published vulnerabilities

• CVE-2026-6657HIGH 8.8

  A flaw in Jupyter Server allows attackers to bypass its cross-origin request (CORS) validation by exploiting how the software validates the `Origin` header. When administrators configure allowed origins using the `allow_origin_pat` setting, the validation logic uses a partial string match rather than a complete one. This means an attacker can craft a domain like `trusted.example.com.evil.com` that will pass validation meant only for `trusted.example.com`. The vulnerability affects versions 1.12.0 through 2.17.0 and impacts CORS headers, WebSocket connections, referer checking, and login redirects, potentially enabling phishing, code execution, and unauthorized access to APIs.

• CVE-2026-44698HIGH 8.3

  Home Assistant Companion apps for iOS and Android contain a vulnerability that allows malicious websites viewed in the app to steal a user's access token and run code as if they were logged into Home Assistant. The flaw stems from improper protection of a JavaScript bridge that connects web content to native app functionality. An attacker can craft a webpage with hidden content that tricks the bridge into executing arbitrary commands with the victim's credentials, effectively compromising their Home Assistant account.

• CVE-2026-11693HIGH 8.1

  Google Chrome versions before 149.0.7827.103 contain a flaw in how plugins are handled that allows a remote attacker to break through Chrome's site isolation security boundary. Site isolation is Chrome's defense mechanism that keeps different websites in separate processes to prevent one compromised site from accessing data from another. An attacker who has already compromised the renderer process—the part of Chrome that executes web pages—can craft a malicious HTML page to bypass this isolation, potentially gaining unauthorized access to sensitive data from other open websites or sessions.

• CVE-2026-47265HIGH 7.5

  AIOHTTP, a popular Python framework for building asynchronous web applications, has a cookie-handling vulnerability that can leak sensitive data during cross-origin redirects. When developers attach cookies directly to individual requests using the `cookies` parameter, those cookies are transmitted to redirect destinations across different origins—a behavior that violates the same-origin principle. An attacker who can trigger a redirect to a malicious domain they control could intercept authentication tokens, session IDs, or other sensitive cookie data. The issue affects all versions prior to 3.14.0 and is now patched.

• CVE-2026-10937MEDIUM 6.5

  CVE-2026-10937 is a same-origin policy bypass vulnerability in Google Chrome's password handling logic. An attacker can craft a malicious HTML page that, when visited by a user, exploits an implementation flaw to circumvent Chrome's same-origin policy protections. This could allow unauthorized script execution or data access across domain boundaries, though the actual impact depends on how the flaw is chained with other browser capabilities. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction to trigger.

• CVE-2026-10996MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how Web Workers are implemented that could allow an attacker to bypass the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited by a user, potentially accesses or modifies content from other websites in the victim's browser session. This requires user interaction (visiting the crafted page) but does not require any special browser features to be enabled.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11036MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a DOM implementation flaw that allows attackers to circumvent the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited, tricks the browser into allowing cross-origin requests or data access that should normally be blocked. This requires user interaction (clicking a link, visiting a site) but does not require any special privileges. While the attack does not expose sensitive data directly, it enables unauthorized modification of web content or session state, potentially leading to account compromise or malware injection.

• CVE-2026-11048MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how extensions are handled that could allow a malicious extension to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data across different origins. An attacker would need to trick a user into installing a malicious extension, but once installed, the extension could potentially access or modify content on websites that it shouldn't normally be able to reach. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11081MEDIUM 6.5

  A flaw in how Google Chrome handles Canvas operations before version 149.0.7827.53 allows attackers to circumvent browser same-origin policy protections. An attacker can craft a malicious HTML page that, when visited by a user, breaks the security boundary that normally prevents one website from accessing data or resources belonging to another. The attack requires user interaction (visiting the page) but no special browser configuration.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11132MEDIUM 6.5

  A flaw in Chrome's Paint component allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53. While an attacker cannot steal data directly through this weakness, they can modify or inject content in ways the browser should have blocked, potentially enabling follow-up attacks that compromise user sessions or inject malware. The flaw requires user interaction (visiting a crafted page) but is otherwise straightforward to exploit.

• CVE-2026-11133MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to bypass the same-origin policy—a critical browser security boundary—through a specially crafted web page. An attacker could trick a user into visiting a malicious site and potentially access or modify content from another origin without permission. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11176MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles media content that could allow an attacker to trick a user into visiting a malicious webpage and steal sensitive data from other websites the user is logged into. The attacker cannot exploit this remotely without user interaction—the victim must visit the crafted page—but once there, the browser's media handling could be bypassed to reveal cross-origin information that should remain private.

• CVE-2026-11194MEDIUM 6.5

  A vulnerability in Google Chrome's network implementation could allow an attacker to trick users into visiting a specially crafted webpage that leaks sensitive data from other websites the user is logged into. The attack requires user interaction (clicking or visiting the malicious page) but does not require special browser configuration or user privileges. While the confidentiality impact is high, the vulnerability does not allow attackers to modify data or disable services.

• CVE-2026-11195MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles MHTML (MIME Encapsulation of Aggregate HTML Documents) content. An attacker can craft a malicious web page that, when visited by a user who performs specific interactions with the page (such as clicking or other UI gestures), leaks sensitive data from websites the user has visited in other browser tabs or windows. The vulnerability requires user interaction to trigger and does not allow attackers to modify data or crash the browser, but it does enable unauthorized access to cross-origin information that should remain private.

• CVE-2026-11200MEDIUM 6.5

  A flaw in Google Chrome's WebRTC implementation allows attackers to steal private data from other websites through a malicious HTML page. An attacker would need to trick a user into visiting their crafted webpage while Chrome is running, but no special technical privileges are required. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11214MEDIUM 6.5

  A flaw in Google Chrome for iOS allows attackers to trick users into visiting a malicious website that can leak data from other websites the user has open in their browser. The attacker needs the victim to interact with the malicious page (such as clicking a link), but no special technical skills or authentication are required on the attacker's side. This is a cross-origin data leak vulnerability affecting Chrome on iPhones and iPads running iOS.

• CVE-2026-11217MEDIUM 6.5

  CVE-2026-11217 is a medium-severity flaw in Google Chrome's Fenced Frames feature that could allow an attacker who has already compromised a renderer process to circumvent Chrome's site isolation security boundary. Site isolation is a core defense that prevents malicious websites from accessing data from other sites in your browser. A remote attacker would need to trick a user into visiting a specially crafted webpage while the renderer has already been compromised, creating a two-stage attack scenario. Google has rated this as low severity on the Chromium scale, though the CVSS score reflects the integrity impact of bypassing site isolation.

• CVE-2026-11226MEDIUM 6.5

  A vulnerability in Google Chrome's PreviewTab feature on Android allows attackers to bypass the browser's same-origin policy—a core security boundary that prevents websites from accessing data belonging to other websites. An attacker would need to craft a malicious HTML page and convince a user to perform specific touch gestures (like swiping or tapping) to trigger the bypass. While the underlying Chromium issue is rated Low severity, the CVSS score reflects the real-world impact: an attacker could alter or exfiltrate data from other websites the user is visiting, though not eavesdrop on encrypted traffic or crash the device.

• CVE-2026-11278MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles CustomTabs—a feature that allows apps to open web content in a customized browser interface. An attacker can craft a malicious HTML page that, when opened by a user, leaks data intended to be protected across different websites. This is a local attack requiring user interaction (clicking or opening the page), but the confidentiality impact is significant because sensitive information from one origin could be exposed to another.

• CVE-2026-37737MEDIUM 6.5

  A flaw in sanic-cors version 2.2.0 and earlier allows attackers to circumvent CORS (Cross-Origin Resource Sharing) origin restrictions. The vulnerability stems from improper validation of allowed origins: an attacker can register a domain name that starts with a trusted origin string to trick the library into allowing cross-origin requests that should have been blocked. For example, if a site trusts 'trusted.com', an attacker registering 'trusted.com.attacker.com' could bypass the allowlist. This exposes authenticated resources to unauthorized cross-origin access.

• CVE-2026-11181MEDIUM 6.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media Session feature is implemented. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's same-origin policy—a fundamental security boundary that prevents websites from accessing data or functionality from other sites without permission. This could allow the attacker to read sensitive information, make unauthorized changes, or disrupt functionality within the context of other websites the user has open. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require any special browser configuration.

• CVE-2026-9989MEDIUM 6.3

  Google Chrome contained a flaw in how it handles media files that allowed attackers to bypass the same-origin policy—a critical browser security boundary. An attacker could craft a malicious video file that, when opened by a user in Chrome, would enable unauthorized access to sensitive data from other websites the user was visiting. The vulnerability requires user interaction (clicking a link or opening a file) but does not require special privileges or complex attack setup.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-34460MEDIUM 5.4

  NamelessMC, a website platform for Minecraft servers, contains a vulnerability in how it handles OAuth authentication callbacks. When a user logs in via OAuth (a third-party authentication method), the application fails to verify a security token called a 'state parameter' before accepting the login. An attacker can exploit this by crafting a malicious link that tricks a victim into logging in with the attacker's own account credentials. Once clicked, the victim's session becomes authenticated as the attacker, potentially granting unauthorized access to the victim's account on that NamelessMC instance. The vulnerability affects NamelessMC versions 2.2.4 and earlier.

• CVE-2026-10010MEDIUM 5.0

  Google Chrome on Android versions prior to 148.0.7778.216 contain a vulnerability in input handling that allows an attacker who has already compromised Chrome's renderer process to bypass site isolation protections through a specially crafted HTML page. Site isolation is a critical Chrome security boundary designed to keep sensitive data from different websites separate in memory. This flaw undermines that protection, though it requires the attacker to have already gained code execution within the browser engine itself.

• CVE-2026-11161MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles cross-origin data transfers. An attacker can craft a malicious HTML page that, when visited by a user, leaks sensitive information from websites the user is logged into or has visited. The vulnerability requires user interaction (clicking or visiting the page) but does not require special browser permissions or user sophistication to exploit.

• CVE-2026-11178MEDIUM 4.3

  A security gap in Chrome's WebView component on Android devices allows attackers to steal sensitive information from websites you visit. By tricking a user into opening a malicious webpage, an attacker can bypass Chrome's normal protections and read data that should be restricted to other websites. This affects Chrome versions before 149.0.7827.53. The vulnerability requires user interaction—someone must click a link or open a malicious page—but doesn't require special privileges or advanced technical setup.

• CVE-2026-11291MEDIUM 4.3

  A flaw in how Google Chrome handles autofill on Android devices allows an attacker to craft a malicious webpage that can bypass the browser's same-origin policy protections. By tricking a user into visiting their page, an attacker could potentially manipulate how Chrome autofills data in unexpected ways. Google rates this as low severity internally, though the CVSS score reflects it as medium risk due to the user interaction required and limited scope of potential impact.

• CVE-2026-11298MEDIUM 4.3

  A vulnerability in Google Chrome for iOS allows attackers to bypass the same-origin policy—a critical security boundary that prevents websites from accessing data belonging to other sites—by tricking users into visiting a specially crafted webpage. The flaw affects Chrome versions before 149.0.7827.53 on iPhones and iPads. While the Chromium project rated this as low severity, the CVSS score reflects a medium severity due to the potential for information disclosure or unauthorized content modification in cross-origin contexts.

• CVE-2026-11309MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces policies for the History feature. An attacker can craft a deceptive webpage that tricks users into believing they're interacting with legitimate browser UI elements or content. While the vulnerability requires user interaction and doesn't directly expose sensitive data or crash the browser, the spoofing capability could be weaponized in social engineering campaigns to steal credentials or manipulate user behavior.

• CVE-2026-44755MEDIUM 4.3

  SAP Business Objects Business Intelligence Platform contains a vulnerability that allows authenticated users to send spoofed emails by manipulating email parameters that the system fails to properly validate. An attacker with legitimate access to the platform could craft emails that appear to come from different senders, potentially damaging organizational trust or enabling social engineering attacks. The vulnerability is limited to integrity concerns—system confidentiality and availability are not compromised.