Description

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.907Z",
  "pubdate": "2026-08-18T15:16:58.907Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Video Conferencing with Zoom versions 4.6.8 and prior.\nThis vulnerability is classified as an input validation and output encoding flaw, specifically manifesting as Contributor Cross-Site Scripting.\nThe security flaw impacts the Zoom video conferencing application across affected client and server components, potentially exposing users to malicious script execution within their session context.\nThe primary risk implication involves the unauthorized execution of arbitrary JavaScript in the context of a victim's session, which can lead to session hijacking, unauthorized actions performed on behalf of the user, and exposure of sensitive client-side data.\nAn attacker capable of exploiting this vulnerability requires the ability to inject malicious payloads into input vectors processed by the application, specifically through contributor-level access or unvalidated input fields.\nSuccessful exploitation relies on the application failing to properly sanitize or encode user-supplied input before rendering it in the user interface, thereby allowing the browser to execute malicious script payloads.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and context-aware output encoding within the Video Conferencing with Zoom application for versions 4.6.8 and prior.\nThe vulnerable component handles user-supplied data from contributors without adequately neutralizing executable markup or JavaScript vectors.\nAttackers leverage this weakness by crafting malicious input payloads containing script tags or event handlers, which are then submitted through application parameters accessible to contributors.\nWhen the vulnerable component processes and renders this input back to other participants or administrative viewers, the browser interprets the payload as legitimate code and executes it within the Document Object Model (DOM) of the victim's session.\nThe attack flow proceeds as follows: First, the malicious contributor injects the XSS payload into a vulnerable input field or parameter handled by the Zoom application. Second, the application stores or reflects this payload without proper sanitization. Third, the victim retrieves or views the affected interface element where the unescaped payload is embedded. Finally, the victim's browser executes the injected script.\nNetwork exposure is inherent to the application's core functionality, as it relies on network communication between clients and conferencing infrastructure to exchange participant data and contributions.\nAuthentication and privilege requirements involve the attacker possessing contributor-level access to the video conference or application interface to supply the malicious input payload.\nPayload behavior includes executing arbitrary JavaScript in the victim's browser, enabling potential post-exploitation impacts such as unauthorized interaction with application features, theft of session cookies, and local data access depending on security controls and Same-Origin Policy enforcement."
}