Cross-Origin — PoC Archivehttps://poc.intelseclab.com/tags/cross-origin/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000WebKit WebGPU `importExternalTexture` Cross-Origin Video Frame Leak (CVE-2026-43700)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43700-webgpu-importexternaltexture-cross-origin-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43700-webgpu-importexternaltexture-cross-origin-leak/High severity — web · CVE-2026-43700. Status: PoC. Affects: WebKit / Safari (GPUDevice.importExternalTexture WebGPU API). Tags: webkit, safari, webgpu, cross-origin, information-disclosure, same-origin-policy-bypass, external-texture, video.webHighwebkitsafariwebgpucross-origininformation-disclosuresame-origin-policy-bypassexternal-texturevideoWebKit Navigation API `NavigateEvent.sourceElement` Cross-Origin DOM Leak (CVE-2026-43735)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43735-webkit-navigateevent-sourceelement-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43735-webkit-navigateevent-sourceelement-leak/High severity — web · CVE-2026-43735. Status: PoC. Affects: WebKit / Safari (Navigation API — NavigateEvent.sourceElement). Tags: webkit, safari, navigation-api, navigateevent, cross-origin, information-disclosure, dom-access, same-origin-policy-bypass, iframe.webHighwebkitsafarinavigation-apinavigateeventcross-origininformation-disclosuredom-accesssame-origin-policy-bypassiframeSliver C2 MCP Server Unauthenticated CORS/Preflight Bypass (CVE-2026-34227)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34227-sliver-mcp-cors-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34227-sliver-mcp-cors-bypass/High severity — web · CVE-2026-34227 (GHSA-6fpf-248c-m7wm). Status: PoC. Affects: Sliver C2 framework — MCP (Model Context Protocol) server interface. Tags: sliver, c2, mcp, cors, csrf, sse, cross-origin, data-exfiltration.webHighsliverc2mcpcorscsrfssecross-origindata-exfiltrationRealtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/High severity (CVSS 7.4) — web · CVE-2026-27579 (GHSA-qh5m-p8jh-hx88). Status: PoC. Affects: realtime-collaboration-platform (karnop), backed by Appwrite. Tags: cors, misconfiguration, appwrite, cross-origin, credentials, data-exposure, session-hijack, javascript.webHighcorsmisconfigurationappwritecross-origincredentialsdata-exposuresession-hijackjavascript