Nishimunea

The issue is related to incorrect security UI in Google Chrome, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This can be achieved by exploiting the incorrect limitation of visualized UI layers. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

The issue is related to incorrect security UI in Payments, allowing a remote attacker to potentially spoof security UI via a crafted HTML page. This could enable the attacker to bypass security restrictions. The severity of this issue is classified as Medium.

The issue is related to insufficient policy enforcement in image handling, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can enable the attacker to bypass security restrictions and gain unauthorized access to protected information.

Name of the Vulnerable Software and Affected Versions: Google Chrome on iOS versions prior to 89.0.4389.72 Description: The issue is related to insufficient data validation in Google Chrome on iOS, which allows a remote attacker to leak cross-origin data via a crafted HTML page. This can lead to unauthorized access to protected information. Recommendations: For Google Chrome on iOS versions prior to 89.0.4389.72, update to version 89.0.4389.72 or later to resolve the issue.

The issue involves the Safari component and allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.

The issue involves the WebKit component and allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses HTTP redirects. This is related to a lack of protection for service data, which can be exploited by a remote attacker to bypass existing access restriction policies or obtain confidential information using a specially formed website.

The issue allows remote attackers to execute arbitrary plugins via a link.

The issue allows attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

The issue is related to insufficient access control in the WebKit component of Safari and iOS. It can be exploited by a remote attacker using a specially crafted website to bypass port restrictions.

The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element. This is related to a lack of protection for service data, which can be exploited by a remote attacker to bypass existing access restriction policies or gain confidential information.

The issue allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL, specifically affecting the CFNetwork HTTPProtocol.

The issue is related to the CSSFontFaceSrcValue::fetch function in the Cascading Style Sheets (CSS) implementation in Blink. This function does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL. As a result, remote web servers can bypass the Same Origin Policy via a redirect. The vulnerability is associated with errors in security settings, which can be exploited by a remote attacker to circumvent existing access restriction policies.

The issue is related to the Blink component in Google Chrome and concerns weaknesses in access control mechanisms. It allows a remote attacker to obtain sensitive information by exploiting the shouldTreatAsUniqueOrigin function in SecurityOrigin.cpp, which fails to ensure the origin of a LocalStorage resource is considered unique. This can be achieved via vectors involving a blob: URL.

The issue is related to errors in security settings of the WebKit component in Safari and iOS. It may allow a remote attacker to gain access to protected information by conducting man-in-the-middle attacks and modifying the data stream between the client and server. This can be achieved by exploiting the lack of enforcement of the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, allowing attackers to obtain sensitive information by sniffing the network or spoofing a report.

The issue allows remote attackers to bypass a Content Security Policy protection mechanism. This can be achieved by using a video control in conjunction with an IMG element within an OBJECT element. The vulnerability is related to errors in security settings, which can be exploited by a remote attacker to bypass access restriction rules using embedded video content management mechanisms.