Loading
Salesforce Enforces New Security Requirements in Summer 2026Read More

Scripts and Styles with Absolute URLs Don’t Load in Salesforce ltng:require After Summer ’26

Publish Date: Jul 29, 2026
Description

In Summer ’26, we made an update to the markup://ltng:require Aura component that fixed a security vulnerability. This fix restricted scripts that reference URLs to only support URLs that match the page origin. All external absolute URLs are rejected.

If your org uses absolute URLs with ltng:require, the Summer ‘26 fix can cause the component to not work properly.

Resolution

One workaround for this script restriction on external absolute URLs being rejected is to update your scripts and styles to use relative URLs (/resource/scriptName) instead where possible.

In some orgs, if the AuraSecStaticResCRUCPerm and AuraSecStaticResCRUCPref settings are enabled, the $Resource resolves to the VF domain, which may differ from the page origin. Contact Salesforce Customer Support to disable these settings if you’re encountering this issue. 

We’re working on a fix that will allow external absolute URLs if they’re in the Lightning or VF domain, or if they’re in your list of Trusted URLs in Setup.

In anticipation of the upcoming fix, we recommend that you add any external absolute URL you want to keep using with this component to the Trusted URLs list.

 

Additional Resources

Lightning Aura Components Developer Guide: Using External CSS

Lightning Component Reference: Require | Legacy Components

Knowledge Article Number

005390235

 
Loading
Salesforce Help | Article