CVE-2026-93752 — CSSOM through 0.5.0 Denial of Service via length Property
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a styles…
Published: 2026-09-18 · CVSS: 8.7 · CVSS 4.0
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7