Zero Radar
← feed
HighVulnerabilityCVE-2026-34157updated 27 Oct 2026, 13:30 UTC

Wails v2 desktop apps: origin check can be bypassed with lookalike domains

A desktop app built with Wails can be tricked into letting a random website call its internal functions. If the app's origin allowlist uses a trailing wildcard, a lookalike domain can get past the check.

Fixed in 2.13.0Official source
SeverityHighCVSS 7.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes2.13.0 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker registers lookalikeDomain shares prefix with allowed origin
  2. 2Page loads in victim's browserAttacker page runs the app's frontend context
  3. 3Wails IPC request sentOrigin check uses unanchored regex
  4. 4Bound Go method executesOrigin wrongly accepted as allowed
  5. ResultAttacker invokes exposed backend methods

What happened

In Wails v2, the originValidator converts a trailing '*' in BindingsAllowedOrigins into an unanchored '.*' regex, so origins that merely share a prefix (e.g. myapp.community for myapp.com*) are accepted for IPC calls to bound Go methods.

Why it is dangerous: An attacker-controlled site can invoke exposed Go backend methods, which may allow file read/write, data access, or command execution depending on what the app exposes.

Are you affected?

You are affected if your app uses Wails v2 (2.0.0 up to but not including 2.13.0) and sets BindingsAllowedOrigins with a trailing wildcard such as https://myapp.com*.

Package / productAffected versionsFixed in
github.com/wailsapp/wails/v2 · go>= 2.0.0, < 2.13.02.13.0

What to do

  1. Update github.com/wailsapp/wails/v2 to 2.13.0 or later
  2. Review BindingsAllowedOrigins and remove trailing wildcards like https://myapp.com*
  3. Use the subdomain form https://*.myapp.com or exact origins instead
  4. Limit which Go methods are bound to the frontend to what is actually needed

Timeline

  1. 27 Oct 2026, 13:29 UTC
    Publicly disclosed
  2. 27 Oct 2026, 13:29 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 13:30 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-34157 · GHSA-47hv-j4px-h3c9
CVSS
7.6 / 10
Disclosed
27 Oct 2026, 13:29 UTC
On Zero Radar
27 Oct 2026, 13:30 UTC (1 min after disclosure)
Last change
27 Oct 2026, 13:30 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Wails v2 desktop apps: origin check can be bypassed with lookalike domains · Zero Radar