Abdulrahman Alqabandi

A logic issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information. The issue is related to errors in state management in WebKitGTK and WPE WebKit modules, which can allow an attacker to access confidential data.

The issue is related to a Use After Free vulnerability in the Vim text editor, specifically with the `find pattern in path` function. This vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to an inappropriate implementation in input handling, allowing a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of data.

The issue is related to the drag and drop function of images in the browser, which can be exploited to run arbitrary code. If a user is convinced to drag and drop an image to their desktop or other folder, the resulting object could be changed into an executable script. This would allow a remote attacker to execute arbitrary code after the user clicks on it.

The issue is related to a heap buffer overflow in the DevTools component of Google Chrome, which could potentially allow an attacker to exploit heap corruption. This could happen if an attacker convinces a user to install a malicious extension and the user visits a crafted HTML page. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

The issue is related to a use after free in the Cast UI, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may impact the confidentiality, integrity, and availability of protected information.

The issue is related to a use after free in developer tools, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page, allowing for arbitrary code execution or denial of service.

The issue is related to an inappropriate implementation in Compositing, allowing a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could lead to unauthorized access to protected information.

The issue is related to a use after free in the Autofill component of Google Chrome, which can be exploited by a remote attacker using a crafted HTML page. This could potentially lead to heap corruption, allowing the attacker to access confidential data, compromise data integrity, or cause a denial of service.

The issue is related to a use after free in Dev Tools, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could potentially lead to arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 89.0.4389.114 Description: The issue is related to a heap buffer overflow in the TabStrip component of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This might enable the attacker to execute arbitrary code or cause a denial of service. Recommendations: For Google Chrome versions prior to 89.0.4389.114, update to version 89.0.4389.114 or later to resolve the issue.

The issue is related to insufficient policy enforcement in the Autofill component of Google Chrome, which can be exploited by a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This is due to weaknesses in the authentication procedure.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 89.0.4389.90 Description: The issue is related to a heap buffer overflow in the implementation of the "Tab Groups" extension in Google Chrome. This can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption. Recommendations: For versions prior to 89.0.4389.90, update to version 89.0.4389.90 or later to resolve the issue.

A heap buffer overflow in the Tab Strip of Google Chrome allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This issue can lead to the execution of arbitrary code.

The issue is related to a use after free in the tab search function, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This may potentially lead to unauthorized access to confidential information or cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 90.0.4430.72 Microsoft Edge (affected versions not specified) Description: The issue is related to the improper implementation of security checks for standard elements in the Autofill feature of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to gain unauthorized access to protected information using a specially crafted web page. The attacker can spoof security UI via a crafted HTML page. Recommendations: For Google Chrome versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 90.0.4430.72 Microsoft Edge (affected versions not specified) Description: The issue is related to the improper implementation of security checks for standard elements in the Autofill feature of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to gain unauthorized access to protected information using a specially crafted web page. The attacker can spoof security UI via a crafted HTML page. Recommendations: For Google Chrome versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an ambiguous file picker design that could confuse users into uploading a whole directory instead of a single file. This could potentially allow a remote attacker to gain unauthorized access to protected information due to errors in the user interface's representation of information. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.

The issue allows the browser to enter fullscreen mode without displaying the security UI, making it possible to attempt a phishing attack or otherwise confuse the user.

The issue is related to an inappropriate implementation in Blink, which is a part of Google Chrome. This allowed a remote attacker to spoof security UI via a crafted HTML page. The vulnerability is associated with errors in the implementation of security checks for standard elements, potentially enabling a remote attacker to conduct spoofing attacks.