Nishimunea

O problema está relacionado a uma interface de usuário de segurança incorreta no Google Chrome, permitindo que um invasor remoto realize spoofing da interface de usuário por meio de uma página HTML maliciosa. Isso pode ser feito explorando a limitação incorreta das camadas visualizadas da interface de usuário. O número estimado de dispositivos potencialmente afetados em todo o mundo não foi fornecido. Não há informações sobre incidentes reais em que esse problema tenha sido explorado.

O problema está relacionado a uma interface de segurança incorreta na seção Pagamentos, permitindo que um invasor remoto possa falsificar a interface de segurança por meio de uma página HTML maliciosa. Isso poderia permitir que o invasor contornasse as restrições de segurança. A gravidade deste problema é classificada como Média.

O problema está relacionado à aplicação insuficiente de políticas no tratamento de imagens, permitindo que um invasor remoto divulgue dados entre origens por meio de uma página HTML maliciosa. Isso pode permitir que o invasor contorne restrições de segurança e obtenha acesso não autorizado a informações protegidas.

**Nome do software vulnerável e versões afetadas: Google Chrome no iOS, versões anteriores à 89.0.4389.72 Descrição: O problema está relacionado à validação insuficiente de dados no Google Chrome no iOS, o que permite que um invasor remoto divulgue dados entre origens por meio de uma página HTML maliciosa. Isso pode levar ao acesso não autorizado a informações protegidas. Recomendações: Para o Google Chrome no iOS em versões anteriores à 89.0.4389.72, atualize para a versão 89.0.4389.72 ou posterior para resolver o problema.

The issue involves the Safari component and allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.

The issue involves the WebKit component and allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses HTTP redirects. This is related to a lack of protection for service data, which can be exploited by a remote attacker to bypass existing access restriction policies or obtain confidential information using a specially formed website.

The issue allows remote attackers to execute arbitrary plugins via a link.

The issue allows attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

The issue is related to insufficient access control in the WebKit component of Safari and iOS. It can be exploited by a remote attacker using a specially crafted website to bypass port restrictions.

The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element. This is related to a lack of protection for service data, which can be exploited by a remote attacker to bypass existing access restriction policies or gain confidential information.

The issue allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL, specifically affecting the CFNetwork HTTPProtocol.

The issue is related to the CSSFontFaceSrcValue::fetch function in the Cascading Style Sheets (CSS) implementation in Blink. This function does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL. As a result, remote web servers can bypass the Same Origin Policy via a redirect. The vulnerability is associated with errors in security settings, which can be exploited by a remote attacker to circumvent existing access restriction policies.

The issue is related to the Blink component in Google Chrome and concerns weaknesses in access control mechanisms. It allows a remote attacker to obtain sensitive information by exploiting the shouldTreatAsUniqueOrigin function in SecurityOrigin.cpp, which fails to ensure the origin of a LocalStorage resource is considered unique. This can be achieved via vectors involving a blob: URL.

The issue is related to errors in security settings of the WebKit component in Safari and iOS. It may allow a remote attacker to gain access to protected information by conducting man-in-the-middle attacks and modifying the data stream between the client and server. This can be achieved by exploiting the lack of enforcement of the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, allowing attackers to obtain sensitive information by sniffing the network or spoofing a report.

The issue allows remote attackers to bypass a Content Security Policy protection mechanism. This can be achieved by using a video control in conjunction with an IMG element within an OBJECT element. The vulnerability is related to errors in security settings, which can be exploited by a remote attacker to bypass access restriction rules using embedded video content management mechanisms.