CVE-2018-20065

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

CVE-2018-20065

Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file...

chromium-browser: User gesture requirement bypass

A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 69 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 69.0.3497.81 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

Brave Software: `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]

Summary: chrome://brave is available for navigation Navigation to chrome://brave + requires local file at . The file loaded in this context has access to private Muon APIs such as chrome.ipcRenderer/remote/webFrame/webViewRequest. Muon API allows executing code on the device. e.g. with...

Huawei Mate 10 Denial of Service Vulnerability

Huawei Mate 10 is a smartphone from Chinese company Huawei Huawei. The Huawei Mate 10 phone suffers from a denial of service vulnerability due to a failure to adapt to specific screen gestures. An attacker could trick a user into installing a malicious application, causing an application that is...

chromium-browser: insufficient user gesture requirements in autofill

Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page...

Huawei Wallet APP suffers from arbitrary gesture password change vulnerability

Huawei Wallet APP is a mobile shopping platform specially created by Huawei Huawei Wallet APP has a vulnerability of arbitrary change of gesture password. In the process of changing the gesture password of Huawei Wallet APP, the user's Huawei account needs to be verified. An attacker with root...

Chrome: bypass for download filetype blacklist, extension->native privesc

This bug report describes a vulnerability that can be used by an extension with some permissions to escalate to native code execution on Linux desktops if Java is installed. No user interaction is required. Chrome permits extensions with appropriate permissions "downloads" and "downloads. open" t...

chromium-browser: universal xss in chrome://downloads

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page...

CVE-2017-5020

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page...

189 Mail Client for Android Gesture Password Bypass Vulnerability

189 mailbox client is a new generation of mailbox service provided by China Telecom for C-network cell phone users and broadband users. A gesture password bypass vulnerability exists in the Android version of 189 Mail Client. The vulnerability allows attackers to use the gesture lock settings to...

WoMail Client for Android - Gesture Password Bypass Vulnerability

Wo Mailbox Client is an email sending and receiving application from China Unicom. A gesture password bypass vulnerability exists in the Android version of Vo Mail Client. The vulnerability allows attackers to bypass the gesture lock to send emails after using the gesture lock setting...

China Mobile 139 Mailbox Android V6.6.1 suffers from gesture password plaintext storage vulnerability

139 Mailbox APP is a general-purpose mailbox client launched by China Mobile. A vulnerability exists in the plaintext storage of gesture passwords in China Mobile 139 Mailbox Android V6.6.1. Since the user's gesture password storage is not encrypted, an attacker can utilize the vulnerability to...

MicroMail Email Client for Android - Gesture Password Insecure Storage Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. Micro Mail Mail Client for Android - There is an insecure storage vulnerability for gesture passwords, when a user uses a gesture password, the password is stored in plaintext and can be...

Upward Financial Management Android Client Gesture Lock Vulnerability

Upward Financial Management is a financial mobile software developed by Beijing Zendai Network Technology Co. Upward Financial Management Android client gesture lock vulnerability, an attacker can bypass a layer of authentication, may cause funds and information leakage harm...

Money Nanny Android Client Gesture Lock Vulnerability

Money Nanny Android client is an Internet investment and wealth management platform focusing on auto finance. The Money Nanny Android client gesture lock vulnerability allows an attacker to bypass a layer of authentication without the need for a gesture password, potentially resulting in the loss...

Gesture Lock Vulnerability in Your Money Management Android Client

You and I loan is an Internet financial investment platform. It provides users with convenient, low-threshold personal loans and investment services. There is a vulnerability in the gesture lock of YouMeLoan's financial management Android client, which allows attackers to bypass a layer of...

Renren Android client gesture lock vulnerability

Renren focuses on personal mortgage business and is committed to providing professional financial information services for individuals and small and medium-sized enterprises. A vulnerability in the gesture lock of Renren Caixuan's Android client allows an attacker to bypass a layer of...

China Telecom WingPay Android client gesture lock has design flaws

Wing Pay is a mobile payment service launched by China Telecom. A design vulnerability exists in the gesture lock of the Wing Pay Android client. By exploiting the vulnerability, an attacker can bypass the gesture lock security mechanism of the Wing Pay Android client and obtain users' private...