CVE-2026-26861: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26861 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the CleverTap Web SDK affecting version 1.15.2 and earlier. The flaw exists in the handleCustomHtmlPreviewPostMessageEvent function within src/util/campaignRender/nativeDisplay.js, where insufficient origin validation via the includes() method allows attackers to bypass the check using crafted subdomains. It was published on February 27, 2026, with a patch reference added on March 3, 2026. The vulnerability carries a CVSS v3.1 base score of 8.3 (High) (Feedly, GitHub Issue).

The root cause is an Origin Validation Error (CWE-346) in the handleCustomHtmlPreviewPostMessageEvent function. The SDK listens for window.postMessage events and validates the sender's origin using event.origin.includes(WVE_URL_ORIGIN.CLEVERTAP) — a substring check that can be trivially bypassed by an attacker-controlled domain such as https://dashboard.clevertap.com.attacker.com. Once the origin check is bypassed, the function JSON-parses the message, extracts the display.details[0].html field, and assigns it directly to element.innerHTML via renderCustomHtml, enabling arbitrary JavaScript execution. No sanitization or encoding is applied to the attacker-controlled HTML before DOM insertion. Exploitation requires user interaction (a victim must visit a page hosting the vulnerable SDK) (GitHub Issue, GitHub Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on any site embedding the vulnerable CleverTap Web SDK. This can lead to session hijacking via cookie theft, unauthorized actions performed on behalf of the user, sensitive data exfiltration, and redirection to malicious websites. The confidentiality and integrity impacts are rated High, with a Low availability impact (Feedly, GitHub Issue).

A public proof-of-concept exploit is available in the GitHub issue report, demonstrating the attack using a crafted window.postMessage payload with a base64-encoded script that executes alert(document.cookie). As of the time of reporting, there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.016% (0.000160), indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Feedly).

1. Reconnaissance: Identify websites that embed the CleverTap Web SDK version 1.15.2 or earlier by inspecting page source or JavaScript bundles for references to clevertap-web-sdk or the checkCustomHtmlNativeDisplayPreview function.
2. Set up attacker-controlled domain: Register or control a domain that contains the string clevertap as a subdomain or path component (e.g., https://dashboard.clevertap.com.attacker.com) to bypass the includes() origin check.
3. Craft malicious postMessage payload: Construct a JSON payload targeting the inapp_notifs structure with a custom-html template type and an HTML payload containing a malicious script:

let payload = btoa(`alert(""+document.cookie);`);
window.postMessage(JSON.stringify({
  inapp_notifs: [{
    display: {
      divId: "body",
      details: [{ html: `<img src=x onerror=eval(atob('${payload}'))>` }]
    },
    msgContent: { templateType: "custom-html", type: 5 }
  }]
}), "*");

4. Deliver to victim: Host the malicious postMessage script on the attacker-controlled domain and lure the victim to a page that opens the target site (which embeds the vulnerable SDK) as a child window or iframe, then sends the crafted message.
5. Achieve code execution: The SDK's handleCustomHtmlPreviewPostMessageEvent passes the origin check (since the attacker domain includes clevertap), parses the payload, and passes the HTML to renderCustomHtml, which injects it into the DOM via innerHTML, executing the attacker's JavaScript in the victim's browser context (GitHub Issue, GitHub Source).

• Network: Unexpected cross-origin postMessage events originating from domains containing clevertap as a substring but not the legitimate CleverTap dashboard domain; outbound requests to unknown third-party domains initiated from pages embedding the CleverTap SDK.
• Browser/Logs: Browser console errors or unexpected JavaScript execution on pages using CleverTap Web SDK; Content Security Policy (CSP) violation reports triggered by inline script execution or unexpected innerHTML assignments.
• File System / SDK: Presence of CleverTap Web SDK version 1.15.2 or earlier in web application dependencies (package.json, node_modules, or bundled JavaScript files).
• Process/Behavior: Unexpected cookie access, session token exfiltration, or DOM manipulation on pages hosting the CleverTap SDK; unusual redirects to external domains following user interaction with CleverTap campaign elements (GitHub Issue).

Upgrade the CleverTap Web SDK to a version newer than 1.15.2, which addresses the origin validation flaw. As a workaround, replace the includes() origin check with strict equality comparison (e.g., event.origin === 'https://dashboard.clevertap.com') in the handleCustomHtmlPreviewPostMessageEvent function. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution and limit trusted message sources. Organizations should audit all deployments of the CleverTap Web SDK to confirm patched versions are in use (GitHub PR, Feedly).

The vulnerability was originally reported to CleverTap by a researcher associated with Razorpay, as noted in the internal PR description. The issue was disclosed publicly via a GitHub issue on June 5, 2025, by researcher Mr-Neutr0n, who provided a detailed proof-of-concept. Social media coverage included posts on Bluesky and Mastodon by security news accounts such as thehackerwire. Community reaction was moderate, with the vulnerability tracked across multiple CVE aggregation platforms shortly after disclosure (GitHub Issue, GitHub PR).