CVE-2026-52843 | Lightpanda is a headless browser designed for AI and automat… | CVSS 9.3 CRITICAL

Description

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.

Metadata

CVE ID: CVE-2026-52843
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-08 18:41 UTC
Published: 2026-07-15 16:16 UTC
Last updated: 2026-07-15 17:37 UTC
Primary CWE: CWE-346
CWE-346: Origin Validation Error
Vendor / Product: lightpanda-io / browser
Sources: cve.org · NVD

Severity & Metrics

9.3 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
lightpanda-io	browser	—	< 0.2.9

Weakness (CWE)

CWE	Source	Description
CWE-346	cna	CWE-346: Origin Validation Error

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.3	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References (4)

https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc
https://github.com/lightpanda-io/browser/pull/2155 https://github.com/lightpanda-io/browser/pull/2155
https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76 https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76
https://github.com/lightpanda-io/browser/releases/tag/0.2.9 https://github.com/lightpanda-io/browser/releases/tag/0.2.9