Loading vulnerability…
CVE-2026-95374 is an improper access-control issue in Chromium's CORS preflight-cache keying. For requests whose origin became tainted after a cross-origin redirect, Chromium sent and evaluated the preflight using Origin: null, but keyed the resulting cache entry using the original request initiator's named origin. An attacker could therefore cause a target to approve a preflight for Origin: null and have that approval reused by a subsequent direct request from the original named origin, bypassing the required preflight. The fix uses an opaque origin as the cache key for tainted-origin requests, separating tainted and untainted preflight-cache entries.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Origin: null but does not approve the attacker's named origin. This creates a blind CSRF-class condition that can cause server-side actions under the victim's authenticated session. Cross-origin response disclosure is not provided because actual-response ACAO validation continues to use the tainted-adjusted origin.If you can’t patch tonight, do this now.
Origin: null unless it is explicitly required and safe. Enforce robust server-side CSRF protections for state-changing operations, including request-specific anti-CSRF tokens and/or strict Origin validation, rather than relying on browser preflight enforcement as an authorization boundary.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.