Cross-Origin Isolation Vulnerability in HCL AION

CVE-2026-35112

What is CVE-2026-35112?

HCL AION is susceptible to a significant security vulnerability due to the absence or improper implementation of the Cross-Origin-Embedder-Policy (COEP) header. This flaw allows embedded cross-origin resources to operate without explicit permissions, consequently diminishing the robustness of cross-origin isolation. Such a scenario can lead to unintended behaviors and potentially expose the application to security risks, especially in environments where sensitive data is handled.

References