CriticalCritical vulnerability
CVE-2026-15639 (CVSS 9.3)
NVD · officialPublished Sep 16, 2026Risk 50/100EPSS 0.4%
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
Technical details
CVSS
9.3
AV:NetworkAC:LowPR:NoneUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source