Is CVE-2026-82019 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82019?

CVE-2026-82019 has a CVSS v3 severity of MEDIUM (4.2).

Back

CVE-2026-82019

Description

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.