Medium severity4.2NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026

CVE-2026-82019

Description

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TripleLift/video-bundle.jsllm-fuzzy
TripleLift/TripleLiftllm-fuzzy

Patches

Vulnerability mechanics

References

hussein-mahmoud7.medium.com/cve-2026-82019-how-a-random-ad-led-to-dom-xss-while-testing-chess-com-f043584e1e68nvd
triplelift.com/creative-technology/nvd
www.vulncheck.com/advisories/triplelift-video-bundle-js-dom-based-xss-via-postmessagenvd

News mentions

No linked articles in our index yet.

cvss	0.273
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000