1Lastbr3Ath

A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information. The issue is related to the WebKitGTK module and allows a remote attacker to access confidential data by exploiting the vulnerability.

A logic issue was addressed with improved state management. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. The issue is related to incorrect restriction of visualizable user interface layers, which could allow a remote attacker to impact data integrity.

The issue is related to an inappropriate implementation in the referrer component of Google Chrome, which allowed a remote attacker to bypass navigation restrictions. This could be achieved via a specially crafted HTML page, potentially leading to the disclosure of protected information.

A logic issue was addressed with improved restrictions. This issue may allow a malicious application to leak sensitive user information. The problem is related to the disclosure of information and could be exploited by a remote attacker to access confidential data.

The issue is related to the WebBrowserPersist component in Firefox, specifically with errors when executing the "Save Page As..." function. This can allow a remote attacker to gain unauthorized access to protected information. The internal WebBrowserPersist code does not use the correct origin context for a resource being saved, which manifests when sub-resources are loaded as part of the "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page.

A security issue exists due to Microsoft Edge's improper handling of redirect requests, allowing it to bypass Cross-Origin Resource Sharing (CORS) redirect restrictions. This enables the browser to follow redirect requests that should be ignored, potentially forcing it to send restricted data to an attacker's chosen destination website.