Sourc7

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 116.0.5845.179 **Description** The issue is related to incorrect security UI in the BFCache component of Google Chrome, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This can be exploited by a remote attacker to conduct spoofing attacks. **Recommendations** For Google Chrome versions prior to 116.0.5845.179, update to version 116.0.5845.179 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 117 Firefox ESR versions prior to 115.2 Thunderbird versions prior to 115.2 **Description** The issue is related to the JavaScript engine SpiderMonkey in Mozilla Firefox, Firefox ESR, and Thunderbird. It involves a potential memory allocation issue when calling `JS::CheckRegExpSyntax`, which could lead to a Syntax Error. If no memory is available, a newly created Out of Memory exception could be mishandled as a Syntax Error, potentially allowing a remote attacker to cause a denial of service. **Recommendations** For Firefox versions prior to 117, update to version 117 or later. For Firefox ESR versions prior to 115.2, update to version 115.2 or later. For Thunderbird versions prior to 115.2, update to version 115.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 110 Mozilla Firefox ESR versions prior to 102.8 Mozilla Thunderbird versions prior to 102.8 **Description** The issue is related to errors in the user interface's information representation. It can be exploited by a remote attacker to force the browser into full-screen mode, potentially causing user confusion or spoofing attacks. A background script invoking `requestFullscreen` and then blocking the main thread could force the browser into fullscreen mode indefinitely. **Recommendations** For Mozilla Firefox versions prior to 110, update to version 110 or later to resolve the issue. For Mozilla Firefox ESR versions prior to 102.8, update to version 102.8 or later to resolve the issue. For Mozilla Thunderbird versions prior to 102.8, update to version 102.8 or later to resolve the issue. As a temporary workaround, consider disabling the `requestFullscreen` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome on Android versions prior to 113.0.5672.63 **Description** The issue is related to an inappropriate implementation in Full Screen Mode, allowing a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially be exploited by a remote attacker. **Recommendations** For Google Chrome on Android versions prior to 113.0.5672.63, update to version 113.0.5672.63 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Full Screen Mode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 106.0.5249.62 Microsoft Edge (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface, allowing a remote attacker to conduct spoofing attacks using a specially crafted web page. This can be achieved via a crafted HTML page, exploiting incorrect security UI in full screen mode. **Recommendations** For Google Chrome versions prior to 106.0.5249.62, update to version 106.0.5249.62 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 104.0.5112.79 Microsoft Edge (affected versions not specified) **Description** The issue is related to an inappropriate implementation of the Fullscreen API in Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page, potentially revealing protected information. **Recommendations** For Google Chrome versions prior to 104.0.5112.79, update to version 104.0.5112.79 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 107.0.5304.62 Microsoft Edge (affected versions not specified) **Description** The issue is related to the inappropriate implementation of full screen mode, allowing a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially impact the integrity, availability, and confidentiality of protected information. The attacker can exploit this issue using a specially crafted HTML page. **Recommendations** For Google Chrome versions prior to 107.0.5304.62, update to version 107.0.5304.62 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 101.0.4951.41 Firefox (affected versions not specified) **Description** The issue is related to a use after free in Codecs, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page. The vulnerability may allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Google Chrome versions prior to 101.0.4951.41, update to version 101.0.4951.41 or later to resolve the issue. For Firefox, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 98.0.4758.80 **Description** The issue is related to an inappropriate implementation in Full Screen Mode, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially lead to the execution of arbitrary code. **Recommendations** For versions prior to 98.0.4758.80, update to version 98.0.4758.80 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Full Screen Mode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 100.0.4896.88 **Description** The issue is related to an inappropriate implementation in full screen mode, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially lead to access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For versions prior to 100.0.4896.88, update to version 100.0.4896.88 or later to resolve the issue. As a temporary workaround, consider avoiding the use of full screen mode in Google Chrome on Android until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 100.0.4896.60 **Description** The issue is related to an inappropriate implementation in Full Screen Mode, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Google Chrome versions prior to 100.0.4896.60, update to version 100.0.4896.60 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Full Screen Mode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 97.0.4692.71 Microsoft Edge (affected versions not specified) **Description** The issue is related to an inappropriate implementation in Compositing, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially lead to unauthorized access to protected information. **Recommendations** For Google Chrome versions prior to 97.0.4692.71, update to version 97.0.4692.71 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 99.0.4844.51 Microsoft Edge (affected versions not specified) **Description** The issue is related to the implementation of Full Screen Mode in browsers, specifically concerning insufficient protection of service data. This could potentially allow an attacker to impact the integrity, availability, and confidentiality of protected information. In Google Chrome on Android, a remote attacker could hide the contents of the Omnibox (URL bar) via a crafted HTML page. **Recommendations** For Google Chrome versions prior to 99.0.4844.51, update to version 99.0.4844.51 or later. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 99.0.4844.51 **Description** The issue is related to the inappropriate implementation of Full screen mode in Google Chrome on Android, allowing a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. This could potentially lead to information disclosure or denial of service. The vulnerability is also related to insufficient protection of service data in Full Screen Mode in Google Chrome and Microsoft Edge browsers. **Recommendations** For Google Chrome versions prior to 99.0.4844.51, update to version 99.0.4844.51 or later to resolve the issue. As a temporary workaround, consider disabling Full screen mode in Google Chrome on Android until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome (affected versions not specified) **Description** A flaw exists in the Blink browser module’s rendering engine due to errors in the implementation of security checks for standard elements. Successful exploitation could allow a remote attacker to gain read and delete access to data using a crafted HTML page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 83 Firefox ESR versions prior to 78.5 Thunderbird versions prior to 78.5 **Description** The issue arises when removing HTML elements during sanitization, which can lead to existing SVG event handlers being retained, resulting in cross-site scripting (XSS). **Recommendations** For Firefox versions prior to 83, update to version 83 or later. For Firefox ESR versions prior to 78.5, update to version 78.5 or later. For Thunderbird versions prior to 78.5, update to version 78.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 83 Firefox ESR versions prior to 78.5 Thunderbird versions prior to 78.5 **Description** A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. This issue could be exploited by an attacker already capable of exploiting an XSS vulnerability in privileged internal pages to bypass the built-in sanitizer. The vulnerability is related to a lack of integrity checking, which could allow a remote attacker to conduct cross-site scripting (XSS) attacks. **Recommendations** For Firefox versions prior to 83, update to version 83 or later to resolve the issue. For Firefox ESR versions prior to 78.5, update to version 78.5 or later to resolve the issue. For Thunderbird versions prior to 78.5, update to version 78.5 or later to resolve the issue.