Skip to main content

CISA issues alert on DNS rebinding affecting browser CORS policies

Source Decision Insights Threat Desk Published November 26, 2025 Companies 2
Human View Machine View

2 companies named across 4 categories, one of 190 articles referencing Microsoft. Previous coverage: Netskope details real-time SIEM integration for zero trust security (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Multiple popular web browsers, including Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox, are affected by a vulnerability involving manipulation of cross-origin resource sharing (CORS) headers that, when combined with a Domain Name System (DNS) rebinding attack, permits sending unauthorized requests to services on arbitrary ports regardless of established CORS policies.

This issue is identified under CVE-2025-8036 and impacts various versions of the browsers mentioned. The vulnerability arises from CORS policies, which enable servers to specify allowed origins for resource sharing, being manipulated through a DNS rebinding technique. This attack exploits how browsers associate hostnames with servers, leveraging DNS records to reassign hostnames to IP addresses of target services. Malicious sites execute JavaScript that sends crafted CORS requests, using permissive headers from attacker-controlled domains to bypass restrictions. Subsequently, the attacker rebinds the hostname to the target service's IP, thus inheriting the relaxed CORS permissions and potentially exfiltrating data.

The potential consequences vary depending on the targets involved, with risks including unintended exposure of private networks and unauthorized retrieval of sensitive information.

Browser vendors have addressed this vulnerability by issuing updates that mitigate the threat. Users are advised to maintain their browser software at current versions to incorporate these security patches.

Users should follow guidance from browser developers to apply the necessary updates promptly to reduce exposure to such DNS rebinding and CORS header manipulation attacks.

Blog post, originally published by Ben Koo at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-dns-rebinding-affecting-browser-cors-policies/",
        "name": "CISA issues alert on DNS rebinding affecting browser CORS policies",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-dns-rebinding-affecting-browser-cors-policies/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Mozilla"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:29:37-06:00",
    "datePublished": "2025-11-26T01:27:25-07:00",
    "description": "CISA reports a browser vulnerability involving DNS rebinding and CORS header manipulation enabling unauthorized data requests.",
    "headline": "CISA issues alert on DNS rebinding affecting browser CORS policies",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Ben Koo"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/652514"
    },
    "keywords": [
      "Attack",
      "Domain Name System",
      "Services",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-dns-rebinding-affecting-browser-cors-policies/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      },
      {
        "@id": "https://decisioninsights.ai/projects/chromium/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/chromium/",
        "name": "Chromium"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Firefox"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages