Cross-origin resource sharing
Summary: An HTML5 cross-origin resource sharing policy controls whether and how content from other domains can interact with the publishing domain, and it can apply per-request access controls based on the URL and other request features. If a logged-in user visits a domain the policy allows, malicious content on that domain can potentially retrieve content from the application and sometimes act within the user's security context.
Key Takeaway: Every domain your CORS policy trusts is a domain whose security posture and intentions you are vouching for, and a vulnerability in one of them can be leveraged to attack your application through that trust relationship.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026