VULNpocalypse
InformationalSupply chainMonitoring

nDiligence Attack the Glass: client-side supply-chain flaw study

nDiligence published Attack the Glass research on runtime client-side rendering supply-chain risk; review third-party code your apps load.

Published
Exploitation
Not confirmed for ATG as a new flaw; the release cites the 2024 Polyfill.io incident as an example of the same technique

What happened

On 12 November 2026, nDiligence, Inc. announced the public release of its Attack the Glass (ATG) research. The announcement is a CyberNewswire press release, carried in identical wording by Hackread, GBHackers and Cyber Security News. The three outlets do not differ on any fact, and none adds independent reporting or verification. All claims below are nDiligence’s.

According to the release:

  • The study covers a weakness in how applications use a person’s own device to build the on-screen interface, load data and run code while the application is in use. This is called runtime client-side rendering.
  • The code, data and media come from dozens or hundreds of suppliers, including the organization’s own systems, its vendors and their vendors.
  • An attacker who controls any one supplier gains placement and access inside the running application. The release says sign-in, encryption, Zero Trust, firewalls and code review all operate before the code is loaded. Once loaded, the code is trusted and nothing checks what it does.
  • The study reports that all 50 types of software and devices examined were vulnerable, with 46 rated Critical or High risk. It examined 10 categories and classifies five effects: deceive, disrupt, degrade, deny and destroy.
  • As precedent, the release cites the February 2024 sale of the domain behind Polyfill.io, a code library loaded by more than 100,000 websites, to a company the U.S. Treasury later sanctioned. It says the altered code ran for months, no automated security tool detected it, and researchers found it that June.
  • The release says the team spent more than two years privately briefing governments before publishing. It states the research was self-funded.

The materials are free under Traffic Light Protocol (TLP) CLEAR. They include a sixteen-chapter whitepaper, twenty online demonstrations and remediation playbooks, at atg.nDiligence.com.

No CVE identifier, patch or fixed version is mentioned in the sources. The release does not name any specific affected product or vendor.

Am I affected?

Not confirmed. The sources describe a class of weakness rather than a specific product flaw. According to nDiligence, it applies to software that builds its interface on the device at runtime, including web browsers, mobile apps, vehicle displays, medical devices and industrial control screens, using code or content from outside suppliers.

The sources do not say how to test for exposure, and they do not report any new exploitation. The study’s ratings come from nDiligence alone, and the sources give no independent assessment of them.

What to do now

  1. Read the ATG whitepaper and remediation playbooks at atg.nDiligence.com. Specific mitigations are not described in the news coverage, so the playbooks are the only source for them named here.
  2. List the external suppliers whose code, data or media your applications load at runtime, including suppliers of your suppliers. This follows from the release’s description of the risk and is not a step the sources prescribe.
  3. Treat any new claim about specific affected products or active exploitation as unconfirmed until a vendor advisory, CERT notice or CVE record appears.

Sources