Lightpanda-io Browser vulnerabilities

• lenovo browser Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass CVE-2026-52842 9.3 CriticalJuly 15, 2026
• lenovo browser Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode CVE-2026-52843 9.3 CriticalJuly 15, 2026