Rayyan Bijoora

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 103.0.5060.53 Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient data validation in URL formatting, allowing a remote attacker to perform domain spoofing via IDN homographs using a crafted domain name. This could potentially lead to unauthorized access to protected information. **Recommendations** For Google Chrome versions prior to 103.0.5060.53, update to version 103.0.5060.53 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 13.1.2 macOS Big Sur versions prior to 11.0.1 **Description** An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing. **Recommendations** For Safari versions prior to 13.1.2, update to Safari 13.1.2 or later to resolve the issue. For macOS Big Sur versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS High Sierra versions prior to 10.13.1 Security Update 2017-001 Sierra versions prior to the update Security Update 2017-004 El Capitan versions prior to the update watchOS versions prior to 4.3 iOS versions prior to 12.1 **Description** The issue is related to an inconsistent user interface that could be exploited by processing a maliciously crafted text message, potentially leading to UI spoofing. This is a result of inadequate state management. **Recommendations** For macOS High Sierra, update to version 10.13.1 or later. For Security Update 2017-001 Sierra, apply the security update. For Security Update 2017-004 El Capitan, apply the security update. For watchOS, update to version 4.3 or later. For iOS, update to version 12.1 or later.

**Name of the Vulnerable Software and Affected Versions** macOS High Sierra versions prior to 10.13.1 Security Update 2017-001 Sierra versions prior to the update Security Update 2017-004 El Capitan versions prior to the update watchOS versions prior to 4.3 iOS versions prior to 12.1 **Description** The issue is related to an inconsistent user interface that could be exploited by processing a maliciously crafted text message, potentially leading to UI spoofing. **Recommendations** For macOS High Sierra, update to version 10.13.1 or later. For Security Update 2017-001 Sierra, apply the security update. For Security Update 2017-004 El Capitan, apply the security update. For watchOS, update to version 4.3 or later. For iOS, update to version 12.1 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 85.0.4183.83 Description: The issue is related to insufficient data validation in the Omnibox feature of Google Chrome, allowing a remote attacker to perform domain spoofing via IDN homographs by using a crafted domain name. This could potentially impact the integrity of data. Recommendations: For versions prior to 85.0.4183.83, update to version 85.0.4183.83 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 83.0.4103.88 Description: The issue is related to an incorrect implementation in the user interface of Google Chrome on iOS, allowing a remote attacker to perform domain spoofing via a crafted HTML page. This can potentially impact the integrity of protected information. Recommendations: For versions prior to 83.0.4103.88, update to version 83.0.4103.88 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Google Chrome on iOS versions prior to 83.0.4103.88 Description: The issue is related to insufficient policy enforcement in the Omnibox component of Google Chrome on iOS, allowing a remote attacker to perform domain spoofing via a crafted URI. This could potentially impact the integrity of protected information. Recommendations: For Google Chrome on iOS versions prior to 83.0.4103.88, update to version 83.0.4103.88 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 77 **Description** The issue arises when certain blank characters in a URL are incorrectly rendered as spaces instead of an encoded URL. **Recommendations** For versions prior to 77, update to version 77 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 77 **Description** The issue allows an attacker to insert certain characters to flip domain and path information in the address bar when browsing a document hosted on an IP address. **Recommendations** For versions prior to 77, update to version 77 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 83.0.4103.61 **Description** The issue is related to insufficient policy enforcement in URL formatting, which can be exploited by a remote attacker to perform domain spoofing via a crafted domain name. This can potentially impact the integrity of data. The vulnerability is associated with an error in the resource management mechanism of the system. **Recommendations** For Google Chrome versions prior to 83.0.4103.61, update to version 83.0.4103.61 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable URL formatting mechanisms until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 **Description** The issue allows for domain spoofing attacks by combining Arabic and Indic vowel marker characters with Latin characters in a domain name. This combination can make the non-Latin character invisible to most viewers with certain font sets on the address bar, as these combined domain names do not display as punycode. The vulnerability is related to an insufficient input validation mechanism in the address bar. **Recommendations** For versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider avoiding the use of combined domain names that include Arabic and Indic vowel marker characters with Latin characters until the issue is resolved. Restrict access to potentially spoofed domains to minimize the risk of exploitation.