CVE-2026-18397CWE-130CWE-252CWE-347CWE-457
CVE-2026-18397
published October 2, 2026
What it is
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.
The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
The record
Technical detail
- CVSS
- 9.4 · NONE
- CVSS v4.0
- 9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS
- 0.00337 · 25.8th percentile
- Weaknesses
- CWE-130 · Improper Handling of Length Parameter Inconsistency; CWE-252 · Unchecked Return Value; CWE-347 · Improper Verification of Cryptographic Signature; CWE-457 · Use of Uninitialized Variable
- Published
- 2026-10-02T02:17Z
References (1)
EPSS history
Timeline