CVE-2026-82019: TripleLift video-bundle.js DOM-based XSS via postMessage
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Publisher pages that run TripleLift's video-bundle.js are exposed. An attacker targets visitors to those pages rather than needing an account on the publisher site.
What does an attacker need to exploit it?
The attacker needs to persuade a victim to visit an attacker-controlled page that sends a crafted postMessage payload to a publisher page running the affected script. No authentication is required, but victim interaction is required.
What could successful exploitation allow?
Successful exploitation can execute arbitrary JavaScript in the publisher's domain. The described impacts include session hijacking and unauthorized manipulation of the page DOM.
How is the vulnerability enabled?
The script processes postMessage payloads without validating their origin. Crafted message content can therefore reach a DOM-based XSS condition.