Narendra Bhati

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 141 Description: Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. Recommendations: Update Firefox for iOS to version 141 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 131.0.6778.69 Microsoft Edge (affected versions not specified) Description: The issue is related to an inappropriate implementation in the Autofill feature, which can allow a remote attacker to perform UI spoofing via a crafted HTML page. This can happen if the attacker convinces a user to engage in specific UI gestures. The vulnerability is associated with errors in presenting information to the user interface. Recommendations: For Google Chrome versions prior to 131.0.6778.69, update to version 131.0.6778.69 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the Autofill feature until a patch is available. Restrict access to potentially vulnerable modules to minimize the risk of exploitation. Avoid using the Autofill feature in affected API endpoints until the issue is resolved.

This issue was addressed through improved state management. An attacker may be able to misuse a trust relationship to download malicious content.

The issue was addressed with improved checks. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

A custom URL scheme handling issue was addressed with improved input validation. Maliciously crafted web content may violate iframe sandboxing policy.

A cross-origin issue existed with `iframe` elements, allowing a malicious website to exfiltrate data cross-origin. This issue was addressed with improved tracking of security origins.

A cookie management issue was addressed with improved state management. A malicious website may exfiltrate data cross-origin.

The issue was addressed with improved UI handling. Visiting a website that frames malicious content may lead to UI spoofing.

The issue is related to errors in the representation of information by the user interface. Exploitation of this issue may allow a remote attacker to conduct spoofing attacks.

The issue is related to errors in the representation of information by the user interface. It may allow a remote attacker to conduct spoofing attacks.

The issue allows a website's permission dialog to persist after navigation away from the site. This was addressed with improved checks.

The issue is related to improper privilege management, allowing local attackers to bypass protection for cookies. This enables them to access sensitive information without proper authorization.

The issue is related to errors in handling files, specifically cookies, which can allow a remote attacker to gain unauthorized access to protected information.

The issue is related to a lack of protection for sensitive data in Microsoft Edge, allowing a remote attacker to disclose protected information.

The issue is related to errors in processing SameSite cookies when opening a website using the "firefox://" protocol handler. This could allow a remote attacker to impact the integrity of protected information.

The issue is related to insufficient access control in Microsoft Edge for Android, which could allow a remote attacker to disclose protected information.

The issue is related to insufficient policy enforcement in the Security UI of Google Chrome and Microsoft Edge browsers, which can be exploited by a remote attacker to leak protected information. This can be achieved via a crafted HTML page, allowing the attacker to disclose cross-origin data.

A window management issue was addressed with improved state management. Visiting a website that frames malicious content may lead to UI spoofing.

The issue is related to errors in security settings, allowing a website to bypass Same Origin Policy. This could enable a remote attacker to circumvent existing security restrictions.

A logic issue was addressed with improved restrictions. Processing web content may lead to arbitrary code execution. This issue is caused by a buffer overflow in the web page display modules of WebKitGTK and WPE WebKit.