Young Min Kim

An observable discrepancy in the Autofill feature allows a remote attacker to obtain sensitive information through the use of a crafted HTML page.

The issue is related to insufficient access control in Mozilla Firefox, allowing a remote attacker to exploit it and set an arbitrary URI in the address bar or browser history. A compromised content process could update the document URI, enabling an attacker to perform such actions.

This issue allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the current process.

The issue is related to insufficient validation of untrusted input in the Safe Browsing feature, allowing a remote attacker to bypass download checking via a crafted HTML page. This could potentially reveal protected information. The estimated number of affected devices and real-world incidents are not specified.

The issue is related to insufficient data validation in extensions, which could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted extension. This could potentially lead to unauthorized access to protected information.

The issue is related to improved UI handling and may cause sensitive data leakage when visiting a maliciously crafted website.

A Cross Site Scripting (XSS) issue allows remote attackers to run arbitrary code via a spoofed `MessageSender.url` to the browser renderer process. This enables attackers to execute malicious scripts, potentially leading to unauthorized actions on the affected system.

The issue concerns the Web Request API, which allowed access to be denied to the extension store or redirected to any URL when users attempted to access the store.

The issue concerns the devtools API in the Whale browser, which allowed extension developers to inject arbitrary JavaScript into the extension store web page via `devtools.inspectedWindow`. This led to extensions downloading and uploading when users opened the developer tool.

The issue allows extensions to replace JavaScript files of the HWP viewer website, which could access local HWP files. When the HWP files are opened, the replaced script can read the files.

The issue allows Whale Bridge, a default extension in Whale browser, to receive any SendMessage request from the content script itself. This could lead to controlling Whale Bridge if the rendering process compromises.

The issue is related to the Autofill tooltips in Firefox, where the text displayed cannot be directly read by JavaScript but is rendered using page fonts. This could lead to side-channel attacks using specially crafted fonts, potentially allowing an attacker to infer the text. The vulnerability is associated with a lack of protection for sensitive data, which could enable an unauthorized party to access protected information.

The issue is related to errors in the representation of information by the user interface. Exploitation of this issue may allow a remote attacker to conduct spoofing attacks.

A Built-in extension in the Whale browser allows attackers to compromise the rendering process, which could lead to controlling browser internal APIs.

The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, which can allow a remote attacker to obtain potentially sensitive information. This can be achieved via a crafted HTML page, exploiting errors in how information is presented to the user interface.

The issue is related to errors in the representation of information by the user interface of the PowerShell interpreter. Exploitation of this issue may allow an attacker to conduct spoofing attacks.