locize's client SDK, before version 4.0.21, registers a message event listener that dispatches to internal handlers without verifying the event's origin. Because validation is performed on an attacker‑controlled payload field instead of the browser–enforced origin, a malicious page can send a crafted postMessage to a locize‑enabled host. The internal handlers can then be invoked, enabling DOM cross‑site scripting and hijacking of key functions such as editKey or commitKey. The vulnerability allows a remote attacker to inject malicious JavaScript into a page that embeds or is embedded by a locize host, potentially compromising user data and application integrity.

All users of the locize client SDK released before 4.0.21 are affected. The vulnerability applies to any integration that loads the SDK on a web page that can be accessed from or embedded by a third‑party domain. The affected product is the locize client SDK; the vendor is locize. Software versions older than 4.0.21 are vulnerable; versions 4.0.21 and newer contain the origin check that mitigates the issue.

CVE-2026-41886 carries a CVSS score of 7.5, indicating a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of origin validation makes it trivial for any page that can send postMessages to a locize‑enabled host. Attackers can exploit the flaw by embedding the vulnerable SDK in a malicious iframe or by opening the SDK page in a new window and sending a crafted message from an attacker‑controlled origin. Because the flaw exists on the client side and does not require privileged credentials, the risk to systems that expose the SDK to untrusted domains is significant.