CVE-2024-5739

The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS UXSS vulnerability. This vulnerability allows for cross-site scripting XSS where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app...

CVE-2024-5739

The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS UXSS vulnerability. This vulnerability allows for cross-site scripting XSS where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app...

CVE-2024-5739

CVE-2024-5739 affects the LINE client for iOS prior to 14.9.0, where the in‑app browser can be abused via a malicious iframe to execute arbitrary JavaScript in the top frame (UXSS). An attacker must trigger a click on the iframe; if exploited, this could capture or alter content and user session ...

CVE-2024-5739

The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS UXSS vulnerability. This vulnerability allows for cross-site scripting XSS where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app...

PT-2024-37114

Name of the Vulnerable Software and Affected Versions: LINE client for iOS versions prior to 14.9.0 Description: The in-app browser of the LINE client contains a Universal XSS UXSS vulnerability, allowing for cross-site scripting XSS where arbitrary JavaScript can be executed in the top frame fro...

MetaMask: Arbitrary file write triggered by deeplink abuse - MetaMask Android

A vulnerability was discovered in the MetaMask Android app that allowed for arbitrary files to be written to disk. Attackers were able to exploit this vulnerability by deeplinking into MetaMask's in-app browser and triggering the immediate download of an attacker-supplied file. Users were not...

Facebook users sue Meta for allegedly building "secret workaround" to Apple privacy safeguards

Last week, two Facebook users filed a class-action complaint against Meta in San Francisco's federal court, alleging the company built a "secret workaround" to Apple's safeguards that protect iPhone users from tracking. Facebook circumvents Apple's privacy rules by opening in-app browsers within...

In-App Browsers and Akamai Client-Side Protection & Compliance

Learn how Akamai's Client-Side Protection & Compliance tracks In-App browser injections to make sure sensitive information is kept safe and private...

In-App Browsers and Akamai Client-Side Protection & Compliance

Learn how Akamai's Client-Side Protection & Compliance tracks In-App browser injections to make sure sensitive information is kept safe and private...

TikTok’s In-App Browser Can Monitor Your Activity on External Websites

By Deeba Ahmed Other iPhone apps using in-app browsers were also tested in the research but TikTok was the only app to monitor keystrokes. This is a post from HackRead.com Read the original post: TikToks In-App Browser Can Monitor Your Activity on External Websites...

Spying on the spies. See what JavaScript commands get injected by in-app browsers

Developer and privacy expert Felix Krause aka KrauseFx announced this week that he had introduced a simple tool to list the JavaScript commands executed by iOS apps when they deployed an in-app web browser to render webpages. He already shared some eye-opening results on his Twitter feed. By...

Facebook’s In-app Browser on iOS Tracks ‘Anything You Do on Any Website’

Users of Apple’s Instagram and Facebook iOS apps are being warned that both use an in-app browser that allows parent company Meta to track ‘every single tap’ users make with external websites accessed via the software. Researcher Felix Krause, who outlined how Meta tracks users in a blog posted...

Elevation Of Privileges

Apache Cordova In-App-Browser is vulnerable to elevation of privileges through cross-site scripting XSS attacks. The callback identifiers are not correctly validated which allows attackers to execute arbitrary JavaScript within the host page. Using this flaw, the attackers can use a gab-iab to ga...

CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

Authentication flaw

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

CVE-2014-0073

The CVE-2014-0073 issue affects Apache Cordova In-App-Browser for iOS: the In-App-Browser plugin (Cordova 2.6.0–2.9.0) and the standalone iOS plugin (org.apache.cordova.inappbrowser, 0.1.0–0.3.1) fail to properly validate callback identifiers, enabling remote attackers to execute arbitrary JavaSc...

[CVE-2014-0072] Apache Cordova File-Transfer insecure defaults

CVE-2014-0073: Apache Cordova In-App-Browser privilege escalation Severity: Important Vendor: The Apache Software Foundation Versions Affected: Cordova In-App-Browser iOS plugin from Cordova versions 2.6.0 to 2.9.0 Cordova In-App-Browser iOS standalone plugin org.apache.cordova.inappbrowser...

Meta: iPhone app XSS in Facebook Mail

From Alex Rice: Hi Jobert, Michiel - I run the Product Security team over at Facebook. ██████ just sent along a note mentioning that you're attempting to contact us with information on a XSS in Facebook's mail site. Can you share any additional details? Thanks! Our response: During a recent...