Social Security Administration genesys: Supply chain dependency on compromised polyfill.io domain (CVE-2026-104375)

The Social Security Administration (SSA) genesys toolkit and the vendored Mavo v0.2.0 library contain hardcoded references to cdn.polyfill.io. This domain was sold to a hostile third party in February 2024 and has been observed serving malicious payloads, including redirects to phishing and scam sites. While the SSA demo page itself does not process user sessions or sensitive data, the toolkit is documented for use in production-ready user interfaces, creating a significant supply-chain risk for any application inheriting this dependency. The vulnerability is tracked as CVE-2026-104375. The repository was updated on 2026-09-17 to remove these references.

Impact

Downstream applications utilizing the genesys toolkit or Mavo v0.2.0 are susceptible to arbitrary JavaScript injection via the hostile-controlled polyfill domain. Successful exploitation would allow attackers to execute malicious code within the context of the user's browser, enabling potential credential theft or redirection to fraudulent websites.

Recommendation

• Audit all applications and prototypes derived from the genesys toolkit or Mavo v0.2.0 to identify and remove references to cdn.polyfill.io.
• Replace any dynamic script loading mechanisms that point to external, unverified CDNs with local hosting or trusted, static mirrors.
• Upgrade any projects using the genesys toolkit to the version released after 2026-09-17.
• Monitor web traffic logs for requests directed at cdn.polyfill.io or googie-anaiytics.com originating from web application frontends.