Niklas Baumstark

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. The vulnerability is related to errors in security settings and can be exploited by a remote attacker to read arbitrary files.

The issue is related to insufficient validation of untrusted input in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service. The vulnerability has been reportedly exploited by actors such as Water Labbu in Electron-based applications, particularly targeting the financial industry.

The issue is related to insufficient access control lockdown in Firefox content processes, which could result in a sandbox escape. This problem only affects Firefox on Windows operating systems. The vulnerability is associated with inadequate input validation, potentially allowing a remote attacker to execute arbitrary code.

A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. This issue is related to the lack of protection for the web page structure, which can be exploited by a remote attacker to compromise data integrity. The vulnerability is particularly concerning for sites closely tied to the Firefox product, such as addons.mozilla.org and accounts.firefox.com, as malicious manipulation of these sites can potentially modify a user's Firefox configuration. To mitigate this, these sites will be isolated into their own process.

The issue allows an attacker to escape the sandbox of a compromised Firefox browser by loading accounts.firefox.com and forcing a log-in to a malicious Firefox Sync account. This can lead to preference settings that disable the sandbox being synchronized to the local machine, causing the compromised browser to restart without the sandbox if a crash is triggered. The vulnerability can be exploited remotely and may allow an attacker to compromise data integrity or cause a denial of service.

The issue is related to insufficient access control in Firefox ESR, Firefox, and the Thunderbird email client. It can be exploited by a remote attacker to cause a denial of service by loading a malicious language pack. A researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation.

The issue is related to incorrect handling of ` proto ` mutations, which may lead to type confusion in IonMonkey JIT code. This can be leveraged for arbitrary memory read and write, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. The vulnerability is related to reading data beyond buffer memory boundaries, which may allow a remote attacker to gain unauthorized access to protected data.

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. The issue is related to errors in data type conversion.

The issue is related to the JavaScript JIT compiler inlining Array.prototype.push with multiple arguments, resulting in the stack pointer being off by 8 bytes after a bailout. This can leak a memory address to the calling function, potentially used as part of an exploit inside the sandboxed content process. The vulnerability is also described as being related to insufficient input validation in the implementation of the Array.prototype.push method in Firefox and Firefox ESR browsers, which could allow a remote attacker to execute arbitrary code.

The issue is related to incorrect reference counting in the AppCache component of the Google Chrome web browser, which is associated with errors in access control for the isolated environment. Exploitation of this issue may allow a remote attacker to escape the sandbox and execute arbitrary code via a crafted HTML page.

The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products.

The issue involves the `802.1X` component and is related to errors in the implementation of the TLS 1.0 protocol. This allows attackers to have an unspecified impact, potentially compromising the confidentiality, integrity, and availability of protected information by leveraging TLS 1.0 support.

The issue involves the `CFNetwork` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This is due to a heap-based buffer overflow in the `CFNetwork` component. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue involves the `CFNetwork` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This is due to a buffer overflow in memory, which can be exploited by a remote attacker.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the WebKit component and allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.

The issue involves the `Speech Framework` component and allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.

The issue involves the `Security` component and allows attackers to conduct sandbox-escape attacks or cause a denial of service via a crafted app.