CVE-2026-82019
TripleLift video-bundle.js DOM-based XSS via postMessage
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.
| CWE | CWE-79 |
| Vendor | triplelift |
| Product | video-bundle.js |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for triplelift video-bundle.js
Be the first to know when new medium vulnerabilities affecting triplelift video-bundle.js are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
TripleLift / video-bundle.js
0 < 2026-04-28
References
hussein-mahmoud7.medium.com: https://hussein-mahmoud7.medium.com/cve-2026-82019-how-a-random-ad-led-to-dom-xss-while-testing-chess-com-f043584e1e68 triplelift.com: https://triplelift.com/creative-technology/ vulncheck.com: https://www.vulncheck.com/advisories/triplelift-video-bundle-js-dom-based-xss-via-postmessage
Credits
Hussein-Mahmoud7