CVE-2026-14933: Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unblu Sparkto a version that resolves this vulnerability.Fixed in 8.39.3 - Upgrade
Upgrade
Unblu Sparkto a version that resolves this vulnerability.Fixed in 7.57.9
Event History
Frequently Asked Questions
Which users and deployment types are exposed?
Both on-premises and cloud deployments are affected in the listed Unblu Spark version ranges. The attacker must be able to participate as an unauthenticated visitor in an embedded co-browsing session; the impact is on the agent who joins that session.
What interaction is required for exploitation?
An agent must join an embedded co-browsing session with the attacker. The attacker then relies on content from the co-browsed page being rendered as HTML in the agent's browser.
What is the impact on a successfully targeted agent?
Arbitrary JavaScript can execute in the browser under the identity and session context of the agent using Agent Desk or Single Conversation Desk. This could expose actions and data available through that agent session.
Is mobile co-apping affected?
No. The issue affects embedded co-browsing; mobile co-apping is not affected.