Ahmed Elmasry

تسمح الثغرة الأمنية في Microsoft Edge (المستند إلى Chromium) لمهاجم غير مصرح له بتنفيذ عملية انتحال عبر الشبكة.

ترتبط المشكلة بتنفيذ غير سليم في مكون الدفع في Google Chrome وMicrosoft Edge، مما يسمح لمهاجم عن بُعد بالتحايل على المصادقة عن طريق التزييف. وقد يمكّن ذلك المهاجم من تزييف واجهة المستخدم باستخدام صفحة HTML مصممة خصيصًا لهذا الغرض، مما قد يسمح له بالتحايل على قيود الأمان الحالية. يجب على المهاجم إقناع المستخدم بالقيام بإجراءات محددة في واجهة المستخدم.

The issue is related to insufficient policy enforcement in Site Isolation, which can be exploited by a remote attacker to bypass navigation restrictions via a crafted HTML page. This could allow the attacker to access confidential information. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to an inappropriate implementation in Prompts, which may allow a remote attacker to perform UI spoofing via a crafted HTML page if a user is convinced to engage in specific UI gestures. This could potentially lead to the exposure of confidential information.

The issue is related to an inappropriate implementation in the Autofill feature, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page. This could potentially impact the integrity of data. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue is related to errors in presenting information to the user interface, which can allow a remote attacker to conduct spoofing attacks.

The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, which may allow a remote attacker to bypass autofill restrictions. This can be achieved by loading a specially crafted HTML page, potentially affecting the integrity of protected information.

The issue is related to an inappropriate implementation in Custom Mobile Tabs, allowing a remote attacker to spoof security UI via a crafted HTML page. This could enable an attacker to manipulate the user interface, potentially leading to security issues. The severity of this issue is classified as Medium.

The issue is related to insufficient policy enforcement in the Autofill feature of Google Chrome, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page. This could potentially lead to security breaches. The severity of this issue is classified as Low by Chromium.

The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page. This could enable an attacker to gain unauthorized access to protected information. The severity of this issue is classified as Low by Chromium.

The issue is related to an inappropriate implementation in Web API Permission Prompts in Google Chrome, which may allow a remote attacker to obfuscate security UI via a crafted HTML page. This could potentially lead to the attacker gaining access to confidential information.

The issue is related to a security feature bypass in Microsoft Edge, where an attacker can exploit it to bypass security restrictions and perform cross-site scripting attacks using a specially crafted malicious web page.

The issue is related to insufficient policy enforcement in the Extensions API, allowing an attacker to bypass navigation restrictions by convincing a user to install a malicious extension. This can be achieved via a crafted Chrome Extension.

The issue is related to the implementation of full screen mode in Google Chrome, specifically concerning errors in data type mixing. This can be exploited by a remote attacker using a specially crafted HTML page to alter the user interface content. The attacker can spoof the security UI, potentially deceiving users.

The issue is related to a security feature bypass vulnerability in Microsoft Edge, which is associated with errors in security settings. An attacker could exploit this vulnerability to disclose protected information using a specially crafted link.

The issue is related to an inappropriate implementation in WebApp Installs, allowing an attacker to bypass security restrictions. This can be achieved by convincing a user to install a malicious web app via a crafted HTML page. The attacker, acting remotely, can exploit this to bypass the install dialog.

The issue is related to insufficient policy enforcement in the Autofill function of Google Chrome for Android. This can be exploited by a remote attacker using a specially crafted HTML page to gain unauthorized access to protected information, potentially leaking cross-origin data.

The issue is related to a spoofing vulnerability in Microsoft Edge and Google Chrome browsers, stemming from inadequate protection of web page structure. This could allow a remote attacker to conduct spoofing attacks by opening a specially crafted malicious file or link.

The issue is related to insufficient policy enforcement in Autofill, allowing a remote attacker to bypass autofill restrictions via a crafted HTML page. This can be achieved by exploiting a vulnerability related to the use of memory after it has been freed, potentially impacting data integrity.