Live › vulnerability › CVE-2026-118696
Several JetBrains IDEs ship an embedded browser that keeps trusting intermediate certificates after they were revoked. An attacker who can present a site using such a certificate could be trusted by the IDE's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Developers who use the embedded browser inside these JetBrains IDEs to view web content, such as documentation or login pages. Teams that do not use the embedded browser feature are less exposed. unknown for finer conditions.
No product ranges from the sources yet.
2026.3, 2026.2.4, 2026.1.5.1, or 2025.3.6.22026.3, 2026.2.4, , or 2026.1.5.12025.3.5.22026.3, 2026.2.4, 2026.1.5.3, or 2025.3.5.32026.3, 2026.2.4.1, 2026.1.5.2, or 2025.3.6.32026.3, 2026.2.6.1, 2026.1.4.1, or 2025.3.6.12026.3, 2026.2.5, 2026.1.4.1, or 2025.3.7.12026.1.3.1 or 2025.3.3.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates
This page as .md · .json · in your agent: get_signal("CVE-2026-118696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.