CVE-2026-52843
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Lightpanda before version 0.2.9, fetch() and XMLHttpRequest unconditionally attach session cookies to every HTTP request, ignoring credentials: omit, same-origin, include, and XMLHttpRequest.withCredentials. This allows an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin.
Risk Assessment
The risk involves potential theft of user session data or unauthorized actions in the victim's context, leading to confidentiality and integrity breaches.
Recommendation
Immediately upgrade Lightpanda to version 0.2.9 or later, which includes a fix for this issue.
Original NVD description (English source)
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.