CVE-2026-33622: XSS in PinchTab via fn Mode

The primary impact of CVE-2026-33622 is the ability for an attacker to execute malicious JavaScript code in the context of a victim's browser session. This can be exploited to steal sensitive information, such as cookies and authentication tokens, allowing the attacker to impersonate the user. Furthermore, an attacker could modify the content of the page displayed to the user, potentially leading to phishing attacks or the injection of malware. The bypass of the security.allowEvaluate setting significantly increases the risk, as it circumvents a designed security control. This vulnerability is particularly concerning given PinchTab's potential use in managing browser tabs and workflows, which could expose a wide range of user data and activities.

1. Reserved2026-03-23
2. Published2026-03-24
3. Modified2026-03-27
4. EPSS updated2026-04-03

The most effective mitigation for CVE-2026-33622 is to upgrade to a patched version of PinchTab that addresses the vulnerability. Unfortunately, a specific fixed version is not provided in the input. Until a patch is released, disabling the 'fn' mode in the PinchTab configuration is a crucial workaround. This prevents the vulnerable endpoints from being exploited. If upgrading is not immediately feasible, carefully review and restrict access to the /wait and /tabs/{id}/wait endpoints. Consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious JavaScript code in the 'fn' parameter. Monitor application logs for unusual activity or attempts to exploit the vulnerable endpoints.