High severity · published Jul 15, 2026
CVE-2026-63175
Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request data. In a multi-user or concurrent deployment, information supplied during one capture could therefore persist and be reused by a subsequent or parallel capture. This could result in the disclosure of authentication cookies, credentials, browser storage, or captured request data belonging to another user. It could also cause requests to be performed with another capture's authentication context, headers, or proxy configuration, potentially enabling unauthorized access to remote resources or interference with other capture operations. The vulnerability is resolved by initializing all capture-specific settings and request data as instance variables in the Capture constructor, ensuring that state is isolated between capture operations.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
PlaywrightCapture · Lookyloo
through v1.40.2 · source: vendor
Affected product
PL
PlaywrightCapture
Lookyloo
More from PlaywrightCapture
7.5
CVE-2026-44439
LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture
6.9
CVE-2026-85242
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
5.1
CVE-2026-73210
Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture