uXSS Vulnerability in DuckDuckGo Browser's AutoConsent JS Bridge Discovered

Cyberpress

uXSS Vulnerability in DuckDuckGo Browser's AutoConsent JS Bridge Discovered

First seen 2 Mar 2026, 14:10 UTC • •31.2

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

A Universal Cross-Site Scripting (uXSS) vulnerability has been identified in the DuckDuckGo browser, specifically within the AutoConsent JavaScript bridge. This flaw allows attackers to exploit the bridge, potentially compromising user security. Users of the DuckDuckGo browser are affected by this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 212d ago How this analysis works

Timeline

2026-03-02

Vulnerability reported in DuckDuckGo browser

Recent

Patch released for the uXSS flaw

More articles in this cluster (3)

Threat Graph

6 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1059.007 - JavaScript

Affected Platform (2)

Android
DuckDuckGo Browser

Vulnerability (2)

XSS
UXSS

Relationships

XSS targets Android
XSS targets DuckDuckGo Browser
UXSS targets Android
UXSS targets DuckDuckGo Browser
Malware targets Android
Malware targets DuckDuckGo Browser
T1059.007 - JavaScript targets Android
T1059.007 - JavaScript targets DuckDuckGo Browser

Continue Reading

Critical XSS Vulnerability in SUSE Rancher Exposes Admin Sessions A critical vulnerability (CVE-2026-88804) in SUSE Rancher allows unauthenticated remote attackers to execute stored cross-site scripting (XSS) attacks via public UI settings. This affects Rancher versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18.…

Multiple WordPress Plugins Face Vulnerabilities Requiring Immediate Updates Three WordPress plugins have been reported with vulnerabilities: the GiveWP plugin (version 4.16.9) has a Cross Site Scripting (XSS) vulnerability, while both the Siteskite (version 2.1.8) and Cartflows (version 3.2.0) plugins have Remote Code Execution (RCE) vulnerabilities. The XSS vulnerability allows attackers to…