Kang Ali

A spoofing issue exists in the WebAuthn component in Firefox for Android. This issue affects Firefox and Thunderbird.

The software contains a flaw.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider being cautious when granting exceptions for websites, especially when accessing them via HTTP, to minimize the risk of exploitation.

A flaw in handling fullscreen transitions may have caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions, resulting in a disrupted browsing experience until the browser is restarted. The bug only affects the application when running on macOS, with other operating systems being unaffected.

The issue is related to a spoofing attack that can bypass authentication. This can be exploited by a remote attacker to impact the integrity of protected information. The vulnerability is caused by a clipboard "paste" button that can persist across tabs, allowing for a spoofing attack.

The issue is related to an inappropriate implementation in Prompts in Google Chrome, allowing a remote attacker to potentially spoof security UI via a crafted HTML page. This could be exploited by a remote attacker using a specially crafted HTML page.

The issue is related to an uncontrolled search path element in the Intel Unite Client software. This could allow an authenticated user to potentially enable escalation of privilege via local access, resulting in unauthorized access to information.