Ylemkimon

An observable discrepancy in the Autofill feature allows a remote attacker to obtain sensitive information through the use of a crafted HTML page.

The issue is related to insufficient validation of untrusted input in the Safe Browsing feature, allowing a remote attacker to bypass download checking via a crafted HTML page. This could potentially reveal protected information. The estimated number of affected devices and real-world incidents are not specified.

The issue is related to insufficient data validation in extensions, which could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted extension. This could potentially lead to unauthorized access to protected information.

The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, which can allow a remote attacker to obtain potentially sensitive information. This can be achieved via a crafted HTML page, exploiting errors in how information is presented to the user interface.

When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the `http.extraheader=AUTHORIZATION` parameter is logged without redaction, allowing anyone with access to the saved logs to obtain the bot credentials.