Most recent entries from all

bdu:2021-06063

certfr-2020-avi-374 — De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un pro…

certfr-2020-avi-374

cnvd-2020-49891

EUVD-2026-37432

fkie_cve-2020-6506

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.

GHSA-36j3-xxf7-4pqg — Android WebView Universal Cross-site Scripting

Affected: npm: react-native-webview

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a `react-native-webview` that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

## Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

### References

https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/

gsd-2020-6506

openSUSE-SU-2020:0845-1 — Security update for chromium

Security update for chromium

RHSA-2020:2643 — Red Hat Security Advisory: chromium-browser security update

chromium-browser: Use after free in speech chromium-browser: Insufficient policy enforcement in WebView chromium-browser: Out of bounds write in V8

UBUNTU-CVE-2020-6506

Affected: Ubuntu:16.04:LTS: chromium-browser, Ubuntu:18.04:LTS: chromium-browser

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.