CVE-2026-52842

Name of the Vulnerable Software and Affected Versions Lightpanda versions prior to 0.3.1

Description Lightpanda, a headless browser for AI and automation, incorrectly computes page origins by searching for the @ character across the entire URL string instead of limiting the search to the authority component. This behavior allows a Same-Origin Policy bypass, where a URL like http://attacker.com/@victim.com/ is fetched from the attacker's domain but treated as originating from http://victim.com. Same-Origin Policy is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin.

Recommendations Update to version 0.3.1.