Improper Restriction of Rendered UI Layers or Frames in Visual Studio Code - CVE-2026-102236
Published: November 10, 2026
Vulnerability identifier: #VU164614
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102236
CWE-ID: CWE-1021
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass Visual Studio Code Workspace Trust protections and execute arbitrary code in the context of the user.
The vulnerability exists due to improper restriction of rendered UI layers or frames in Visual Studio Code when opening a specially crafted workspace. A remote attacker can convince a user to open such a workspace to execute attacker-controlled commands or code without the user first granting trust.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102236
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3