CVE-2026-52842 is an origin validation error (CWE-346) in the Lightpanda headless browser before version 0.3.1. The browser incorrectly searches for the '@' character across the entire URL string rather than restricting this search to the authority component when computing the page origin. This parsing error allows an attacker-controlled URL such as 'http://attacker.com/@victim.com/' to be fetched from attacker.com but treated as if it originated from victim.com, resulting in a complete bypass of the Same-Origin Policy. This vulnerability has a CVSS 3.1 score of 9.3, indicating critical severity. The issue is resolved in Lightpanda version 0.3.1.

This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially enabling unauthorized access to sensitive data or actions within the context of victim.com when using vulnerable versions of Lightpanda. The bypass undermines a fundamental browser security mechanism, leading to high confidentiality and integrity impacts. Availability is not affected.

Upgrade Lightpanda to version 0.3.1 or later, where this origin validation issue is fixed. Since the vulnerability is resolved in 0.3.1, applying this official fix fully mitigates the risk.