Live › vulnerability › CVE-2026-121451
AB Download Manager before 1.11.2 accepts unauthenticated requests from its browser integration API, so a malicious web page can make the user's browser send a request that writes attacker-chosen files to arbitrary paths. An attacker can place payloads in startup folders to run code on the next login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Desktop users running AB Download Manager before 1.11.2 with its browser integration enabled. Exposure comes from visiting a malicious web page while the app is running, so machines without the app or with the integration off can skip it.
No product ranges from the sources yet.
1.11.2 are in scope.1.11.2 or later (per the advisory range 'before 1.11.2').Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.
This page as .md · .json · in your agent: get_signal("CVE-2026-121451")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.