Is CVE-2026-42184 actively exploited?

No active exploitation of CVE-2026-42184 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42184 be exploited remotely?

Yes. CVE-2026-42184 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42184?

CVE-2026-42184 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-42184

HIGH

CVE-2026-42184

CWE-918Published: May 27, 2026· Updated: Jun 2, 2026

8.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.7th

Official Description

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.

NVD Source

Technical Analysis

CVE-2026-42184 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.