CVE-2026-1029

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 IBM ART versions 9.0 through 9.0.0.2 Tor Browser version 15.0.x Mullvad Browser (affected versions not specified) Firefox-hardened forks (affected versions not specified)

Description IBM products are subject to cross-site scripting, which allows users to embed arbitrary JavaScript code in the Web UI to alter functionality and potentially disclose credentials within a trusted session.

Tor Browser and related browsers are affected by a side-channel timing attack known as the Stigma Exploit. This issue exists in the WebGPU API implementation within the Firefox ESR engine. A malicious WebGPU script can measure nanosecond-level differences in the hardware clock of the Graphics Processing Unit (GPU) to create a unique hardware fingerprint. This fingerprint can be used to link a Tor session to a user's real IP and physical identity if the user has previously visited a malicious site on a regular browser. This is a zero-click attack that bypasses First-Party Isolation.

Recommendations For IBM Common Licensing Agent versions 9.0 through 9.0.0.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For IBM ART versions 9.0 through 9.0.0.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Tor Browser version 15.0.x, set the Security Level to Safest to disable JavaScript. For Tor Browser version 15.0.x, set the dom.webgpu.enabled variable to false in about:config. For Tor Browser version 15.0.x, set the gfx.webrender.all variable to false in about:config to use software rendering. For Mullvad Browser, set the Security Level to Safest to disable JavaScript. For Mullvad Browser, set the dom.webgpu.enabled variable to false in about:config. For Mullvad Browser, set the gfx.webrender.all variable to false in about:config to use software rendering. For Firefox-hardened forks, set the Security Level to Safest to disable JavaScript. For Firefox-hardened forks, set the dom.webgpu.enabled variable to false in about:config. For Firefox-hardened forks, set the gfx.webrender.all variable to false in about:config to use software rendering.