Security Vulnerability in Szafir SDK Web by Elektroniczny Podpis

CVE-2026-26927

What is CVE-2026-26927?

The Szafir SDK Web browser plug-in poses a significant vulnerability where an unauthenticated attacker can manipulate the URL used to launch the SzafirHost application. This is achieved by crafting a malicious website that uses the Szafir SDK Web to launch the application with arbitrary arguments. Notably, the application does not validate the document_base_url parameter, allowing attackers to display the confirmation prompt with a misleading URL. When users approve this action, the application executes within the context of the attacker’s website, enabling the download of harmful files and libraries without proper user interaction if the 'remember' option is selected. Users are encouraged to update to version 0.0.17.4 or later to mitigate this risk.

References