RCE in JXBrowser Java Script/Java bridge
Summary: PortSwigger researcher Gareth Heyes found that a JavaScript-to-Java bridge built with the JXBrowser library could be abused from a web page to reach classes beyond the one supplied, eventually using getDeclaredField to access the private current runtime property and execute the calculator. TeamDev patched JXBrowser to support a whitelist of allowed properties and methods via the @JSAccessible annotation, but the whitelist is not enforced if an application does not use that annotation anywhere.
What you should know: Any website rendered in a JXBrowser client running code with this bridge could potentially take complete control of the client, and applications that never adopt @JSAccessible remain exposed to the same exploit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026