77532 matches found
CVE-2026-76036
Affected: Dawn, the open-source WebGPU implementation library bundled in Chrome on Android, versions prior to 151.0.7922.169. Cause: A buffer overflow in Dawn allows writing beyond memory boundaries. Impact: A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a victi...
CVE-2026-68927
MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...
GHSA-8J49-MMCX-4MP5 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...
GHSA-95PX-34X5-P37H MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check
MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...
CVE-2026-68922
In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...
CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
EUVD-2026-60693
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74980
A clickjacking flaw in the Downloads component of Firefox for Android allowed a malicious page to trick users into initiating downloads. The issue was resolved in Firefox 154; users should update to that version or later. No exploit details are provided in the available documents.
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975 Spoofing issue in the Downloads component in Firefox for Android
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
EUVD-2026-60689
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975
A spoofing issue in the Downloads component of Firefox for Android allows a remote attacker to trick users into downloading or interacting with malicious content, with CVSS 5.4 (MEDIUM). It was fixed in Firefox 154. No in-the-wild exploitation is reported.