Universal XSS in Android WebView

Overview A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native...

Cross-site Scripting (XSS)

Overview react-native-webview is a React Native WebView component for iOS, Android, macOS, and Windows Affected versions of this package are vulnerable to Cross-site Scripting XSS. A universal cross-site scripting UXSS vulnerability has been identified in the Android WebView system component, whi...

UBUNTU-CVE-2020-6538

Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2020-16873

The CVE-2020-16873 entry describes a spoofing vulnerability in Microsoft Xamarin.Forms tied to the Android WebView default settings before 83.0.4103.106. The issue allows an attacker to execute arbitrary Javascript if a user visits a malicious website or a site serving malicious code via Xamarin....

PT-2020-4018 · Microsoft +1 · Xamarin.Forms +1

Name of the Vulnerable Software and Affected Versions: Microsoft Xamarin.Forms versions prior to 83.0.4103.106 Description: A spoofing issue exists due to the default settings on Android WebView, allowing an attacker to execute arbitrary Javascript code on a target system. The attack requires the...

Android App "Mercari" (Japan version) vulnerable to arbitrary method execution of the Java object

Overview Android App "Mercari" Japan version provided by Mercari, Inc. contains vulnerability that an arbitrary Java method execution CWE-749 due to inadequate restrictions on addJavascriptInterface of WebView class. Taichi Kotake of Akatsuki Inc. reported this vulnerability to IPA. JPCERT/CC...

X (Formerly Twitter): Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506

Summary: CVSS score: 8.1 / High / CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Embargo notice: Do Not Disclose publicly until https://crbug.com/1083819 is disclosed. Twitter for Android is affected by a UXSS vulnerability due to its configuration of Android WebView and CVE-2020-6506. Vendor...

EUVD-2020-0969

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI...

Android WebView Cross Domain Access Vulnerability

Android WebView web view is a control for displaying html text content on Android platform. Android WebView has a cross domain access vulnerability. The vulnerability occurs because the Android application WebView opens the file domain access, and allows the file domain to access the http domain,...

CVE-2016-6754

A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a remote attacker to execute arbitrary code when the user is navigating to a website. This issue is rated as High due to the possibility of remote code...

Google Chrome V8 Engine Remote Code Execution Vulnerability (BadKernel)

Google V8 JavaScript Engine is the United States Google Google company for the Chrome browser developed a set of open source JavaScript engine. A remote code execution vulnerability exists in Google Chrome V8 engine versions 3.20 to 4.2, due to the "observeacceptinvalid" exception type being...

New Dark Web Marketplace Offers Zero-Day Exploits to Hackers

Hackers have sold secrets of zero-day exploits in the underground Dark Web marketplace such as the Silk Road and its various successors for years, and now a new deep web marketplace has appeared that offers anonymity protection to its sellers. A new Dark Web market, called "TheRealDeal," has open...

Boat Browser 8.0 / 8.0.1 Remote Code Execution

CreatMalTxt POC - WebView var obj; function TestVulnerability temp="not"; var myObject = window; for var name in myObject if myObject.hasOwnPropertyname try temp=myObjectname.getClass.forName'java.lang.Runtime'.getMethod'getRuntime',null.invokenull,null; catche iftemp=="not"...

UBUNTU-CVE-2012-6636

The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application...

Android Browser and WebView addJavascriptInterface - Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Android", :arch = ARCHARMLE, :javascript = true, :rank = ExcellentRanking, :vulntest = %Q| for i in top try...

JVN#86318665: jigbrowser+ for Android vulnerable in the WebView class

jigbrowser+ is a web browser for a smartphone. jigbrowser+ for Android contains a vulnerability in the WebView class. Impact If a user of the affected product uses other malicious Android application, information managed by the affected product may be disclosed. Solution Update the software Updat...