CVE-2026-82019
Received Received - Intake

DOM-based XSS in TripleLift Video-Bundle.js Ad Script

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82019
EUVD
EUVD-2026-77522

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
triplelift video_bundle_js to 2026-04-28 (exc)
triplelift video_bundle.js to 2026-04-28 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82019 is a DOM-based cross-site scripting (XSS) vulnerability in TripleLift's ad rendering script (video-bundle.js). It allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers trick victims into visiting a malicious page that sends malicious postMessage events to a publisher's page running the vulnerable script.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious postMessage events targeting video-bundle.js. Check browser console logs for unexpected JavaScript execution or DOM modifications. Inspect postMessage handlers in the ad script for origin validation flaws. Use tools like Burp Suite or browser developer tools to intercept and analyze postMessage payloads.

Impact Analysis

This vulnerability can lead to session hijacking where attackers steal user sessions. It also enables unauthorized DOM manipulation on the publisher's site, potentially altering content or stealing sensitive data. Attackers could inject malicious scripts to perform actions on behalf of users or redirect them to phishing pages.

Compliance Impact

This DOM-based XSS vulnerability could potentially violate compliance with GDPR by enabling unauthorized access to user data through session hijacking or DOM manipulation on a publisher's domain. It may also conflict with HIPAA if exploited on healthcare-related publisher sites to access protected health information.

Mitigation Strategies

Immediately update to the latest version of video-bundle.js released after April 28, 2026. Implement strict origin validation for all postMessage event listeners in the ad script. Add Content Security Policy (CSP) headers to restrict inline script execution. Monitor for unauthorized DOM changes or session hijacking attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart