Back to security portal
Reflected cross-site scripting (XSS) vulnerability on connect.trezor.io via hash fragment script injection
Reported on March 25, 2026
A vulnerability was discovered in the documentation endpoint of Trezor Connect, where a URL parameter could be abused to load and execute arbitrary JavaScript within the trusted domain. This issue resulted in a reflected cross-site scripting (XSS) vulnerability, allowing malicious scripts to run in the context of the official site.
Reported by Vipul Sahu
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- THP pairing could be completed without the pairing codeJune 22, 2026
- Desktop update could install before signature verification completedJune 16, 2026
- Solana account-creation confirmation completenessJune 14, 2026
- Solana signing display improvementJune 12, 2026
- Coordination fee cap shown on CoinJoin authorizationJune 3, 2026
- Solana token-transfer recipient spoofing via Address Lookup Table referenceJune 1, 2026