47
47
42
MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.
63
Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks
MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.
A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.
55
42
47
42
Chrome, Firefox Updates Patch 115 Vulnerabilities
Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.
Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.
55
47
42
42
42
42
60
42
60
47
47
42
47
42
42
42
47
47
42
42
42
47
47
42
42
42
42
42
42
47
42
42