CVE-2026-35113 · Other
NO FIX YET
HCL AION does not send a proper Cross-Origin-Opener-Policy header, so other websites can share a browsing context with it. An attacker who lures a user to a malicious page could possibly carry out cross-window attacks with unintended effects.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
HCL AION is an enterprise product run by organisations, so the exposure is in the deployed web application's response headers. The sources do not say which AION versions are affected or which configurations are exposed. unknown
Who cares hcl-aion, web-apps
Unknown from the sources.
No fix yet, per the sources.
HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.