Niklasb

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 89.0.4389.128 **Description** The issue is related to insufficient validation of untrusted input in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service. The vulnerability has been reportedly exploited by actors such as Water Labbu in Electron-based applications, particularly targeting the financial industry. **Recommendations** For Google Chrome versions prior to 89.0.4389.128, update to version 89.0.4389.128 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable API endpoints or disabling the use of untrusted input in the V8 engine until a patch is applied. Avoid using crafted HTML pages that could exploit the heap corruption vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12 tvOS versions prior to 12 watchOS versions prior to 5 Safari versions prior to 12 iTunes for Windows versions prior to 12.9 iCloud for Windows versions prior to 7.7 **Description** The issue is related to multiple memory corruption problems that were addressed with improved memory handling. **Recommendations** For iOS versions prior to 12, update to version 12 or later. For tvOS versions prior to 12, update to version 12 or later. For watchOS versions prior to 5, update to version 5 or later. For Safari versions prior to 12, update to version 12 or later. For iTunes for Windows versions prior to 12.9, update to version 12.9 or later. For iCloud for Windows versions prior to 7.7, update to version 7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 10.3 **Description** The issue is related to a use after free vulnerability in the String.replace method in JavaScriptCore. This allows remote attackers to execute arbitrary code via a crafted web page or a crafted file. The vulnerability was demonstrated at Pwn2Own, indicating its potential for real-world exploitation. **Recommendations** For versions prior to 10.3, update to iOS 10.3 or later to resolve the issue.