Description

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-11-06T14:17:13.237Z",
  "pubdate": "2026-11-06T14:17:13.237Z",
  "executiveSummary": "HCL AION is vulnerable due to a missing or insecure Cross-Origin-Opener-Policy (COOP) HTTP response header.\nThis vulnerability allows the application to share a browsing context with cross-origin documents, effectively bypassing the process-isolation mechanisms enforced by modern browsers.\nThe primary risk involves enabling cross-window attacks, where a malicious origin can maintain a window reference to the victim's session.\nSuch a configuration facilitates side-channel attacks, such as Spectre-based information disclosure or unauthorized cross-document interaction.\nExploitation does not typically require authentication, as the flaw resides in the HTTP response configuration, making the application susceptible to external web-based attacks if a user navigates to a malicious site while having an active HCL AION session.\nThe lack of strict process isolation expands the attack surface for advanced persistent threats seeking to exfiltrate sensitive data through cross-origin information leaks.",
  "technicalDetails": "The vulnerability stems from the absence of the Cross-Origin-Opener-Policy (COOP) header in the HTTP response headers served by HCL AION. COOP is a security mechanism that allows a document to ensure that its top-level browsing context is isolated from other documents by requiring them to be in different browsing context groups.\nWhen a web application fails to implement COOP, or sets it to an insecure configuration such as 'unsafe-none', the browser is permitted to place the application's document into the same browsing context group as a cross-origin document. This typically occurs when the application is opened via a window.open() call or a target='_blank' link from an attacker-controlled site.\nThe attack flow follows a specific sequence: First, the attacker lures an authenticated user to a malicious web page. Second, the attacker triggers a navigation or a window reference to the HCL AION application. Because the application lacks the 'same-origin' or 'same-origin-allow-popups' policy, the browser fails to isolate the processes. Third, the attacker maintains a cross-origin reference to the HCL AION window. This reference allows the malicious script to potentially interact with the browsing context or use the shared process to perform side-channel measurements.\nThe technical core of the impact lies in the ability for a malicious origin to bypass the Same-Origin Policy (SOP) limitations regarding window references. This isolation failure allows attackers to potentially conduct 'Cross-Origin-Window-Proxy' manipulation, which can lead to information leakage through memory inspection if the browser is susceptible to side-channel exploits such as Spectre. Furthermore, it prevents the browser from fully enforcing Site Isolation, leaving sensitive cookies and DOM state exposed to context-sharing-based exploits.\nThe vulnerability is inherent to the web server configuration or the application framework's header generation logic. It is not dependent on specific user privileges or authentication status, as the exposure of the browsing context occurs at the transport layer before application-level security controls are fully realized. The absence of this header effectively nullifies the defensive layer intended to prevent malicious documents from influencing the execution environment of the HCL AION session."
}