Описание
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
Ссылки
- Issue TrackingPermissions Required
- Vendor Advisory
- Issue TrackingPermissions Required
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 122.0 (исключая)
cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*
EPSS
Процентиль: 10%
0.00036
Низкий
7.5 High
CVSS3
Дефекты
CWE-362
CWE-362
Связанные уязвимости
CVSS3: 7.5
github
около 2 лет назад
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
EPSS
Процентиль: 10%
0.00036
Низкий
7.5 High
CVSS3
Дефекты
CWE-362
CWE-362