Mixed content
Summary: PortSwigger Research describes a mixed content vulnerability, where an application loads pages over HTTPS that in turn load other resources over unencrypted connections. An attacker positioned to view a legitimate user's traffic could record and monitor their interactions with those resources, or modify them to influence the application's appearance and behavior, though browsers may warn users and disable affected page components, so the issue currently affects usability more than security.
Bottom line: Exploiting this requires an attacker positioned to eavesdrop on the victim's traffic - on public Wi-Fi, a shared corporate or home network with a compromised computer, or at the user's ISP or the application's hosting infrastructure - and common defenses such as switched networks are not sufficient to stop it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026