CVE-2026-102236 · Runtime
NO FIX YET
Visual Studio Code does not properly restrict rendered UI layers or frames, which lets an unauthorized attacker bypass a security feature. The sources describe the attack as local and give no further detail.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Developers who run Visual Studio Code on their machines are likely the affected group, since the sources describe a local attack. The sources do not name affected versions or the exact security feature bypassed. unknown
Who cares developer-tools, linux, macos, visual-studio-code, windows
code --version and compare it against the fixed release named in the vendor advisoryNo fix yet, per the sources.
Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.