{"id":"CVE-2026-35113","kind":"vulnerability","aliases":["CVE-2026-35113"],"related":[],"title":"HCL AION: missing COOP header lets cross-origin pages share browsing context","description":"HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION does not send a proper Cross-Origin-Opener-Policy header, so other websites can share a browsing context with it. An attacker who lures a user to a malicious page could possibly carry out cross-window attacks with unintended effects.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","web-apps"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T14:17:13+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:38+00:00","updated_at":"2026-11-06T14:43:38+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T14:43:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HCL AION: missing COOP header lets cross-origin pages share browsing context","impact":"low","summary":"HCL AION does not send a proper Cross-Origin-Opener-Policy header, so other websites can share a browsing context with it. An attacker who lures a user to a malicious page could possibly carry out cross-window attacks with unintended effects.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","web-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"cross-window attacks may cause unintended behavior in the application","analyst_note":"Check the HCL AION security bulletin for affected versions, fixed versions and header configuration details.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"HCL AION is an enterprise product run by organisations, so the exposure is in the deployed web application's response headers. The sources do not say which AION versions are affected or which configurations are exposed. unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":4238,"output_tokens":421,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-35113':16A,19A 'affect':74C 'aion':2A,22B,28B,72C 'allow':91C 'app':26B 'applic':103C 'attack':51B,67B,110C 'behavior':115C 'brows':12A,46B,99C 'carri':62B 'certain':120C 'condit':121C 'context':13A,47B,100C 'coop':4A,85C 'could':60B 'cross':8A,35B,65B,81C,93C,108C 'cross-origin':7A,92C 'cross-origin-opener-polici':34B,80C 'cross-window':64B,107C 'cve':14A,17A 'document':95C 'effect':70B 'enabl':106C 'hcl':1A,21B,27B,71C 'hcl-aion':20B 'header':5A,39B,86C 'impact':118C 'insecur':90C 'let':6A 'lure':53B 'malici':58B 'may':105C 'miss':3A,88C 'open':37B,83C 'origin':9A,36B,82C,94C 'page':10A,59B 'polici':38B,84C 'possibl':61B 'potenti':111C 'proper':33B 'result':112C 'secur':117C 'send':31B 'share':11A,44B,97C 'unintend':69B,114C 'user':55B 'vulner':77C 'web':25B 'web-app':24B 'websit':42B 'window':66B,109C","nicknames":[],"mitigations":[],"who_affected":"HCL AION is an enterprise product run by organisations, so the exposure is in the deployed web application's response headers. The sources do not say which AION versions are affected or which configurations are exposed. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other","webapps"],"campaign_type":null,"search_a":"'-2026':15A,18A '-35113':16A,19A 'aion':2A 'brows':12A 'context':13A 'coop':4A 'cross':8A 'cross-origin':7A 'cve':14A,17A 'hcl':1A 'header':5A 'let':6A 'miss':3A 'origin':9A 'page':10A 'share':11A","search_b":"'aion':22B,28B 'app':26B 'attack':51B,67B 'brows':46B 'carri':62B 'context':47B 'could':60B 'cross':35B,65B 'cross-origin-opener-polici':34B 'cross-window':64B 'effect':70B 'hcl':21B,27B 'hcl-aion':20B 'header':39B 'lure':53B 'malici':58B 'open':37B 'origin':36B 'page':59B 'polici':38B 'possibl':61B 'proper':33B 'send':31B 'share':44B 'unintend':69B 'user':55B 'web':25B 'web-app':24B 'websit':42B 'window':66B","search_c":"'affect':74C 'aion':72C 'allow':91C 'applic':103C 'attack':110C 'behavior':115C 'brows':99C 'certain':120C 'condit':121C 'context':100C 'coop':85C 'cross':81C,93C,108C 'cross-origin':92C 'cross-origin-opener-polici':80C 'cross-window':107C 'document':95C 'enabl':106C 'hcl':71C 'header':86C 'impact':118C 'insecur':90C 'may':105C 'miss':88C 'open':83C 'origin':82C,94C 'polici':84C 'potenti':111C 'result':112C 'secur':117C 'share':97C 'unintend':114C 'vulner':77C 'window':109C","first_public_at":"2026-11-06T14:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35113","severity":null,"published_at":"2026-11-06T14:17:13+00:00","modified_at":"2026-11-06T14:17:13+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}