Input validation

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages, as demonstrated by an interpretation confli...

CVE-2016-5191

Google Chrome UXSS in CVE-2016-5191 due to insufficient validation of crafted HTML data in bookmark handling. Desktop Chrome before 54.0.2840.59 (Windows/Mac/Linux) and Android before 54.0.2840.85 could be tricked via a crafted http://javascript:[email protected] URL to inject scripts/HTML. Imp...

CVE-2016-5181

CVE-2016-5181 is a cross-site scripting (UXSS) vulnerability in the Blink component of the Chromium/Chrome browser. The initial description notes exploitation via crafted HTML to run arbitrary scripts when the DOM is inconsistent, affecting Chrome before 54.0.2840.59 on Windows/macOS/Linux and 54...

CVE-2016-5181

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages...

CVE-2016-5191

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages, as demonstrated by an interpretation confli...

CVE-2016-5181

Removed by vendor...

KLA10914 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome prior to 54.0.2840.59. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, inject code or possibly cause denial of service. Below is a complete list of vulnerabilities: 1. Missed...

Google Chrome < 55.0.2883.75 Multiple Vulnerabilities

Binary data 9829.pasl...

Microsoft Edge UXSS-the adventure of the endless world-vulnerability warning-the black bar safety net

Today we will work together to onlookers under the Microsoft Edge there is some design problem-when these issues are combined it will form a universal cross-site scripting attacks UXSS in. If you want to figure out this vulnerability, but you're just not a security researcher, you can try so...

Brave Software: Sending arbitrary IPC messages via overriding Array.prototype.push

Summary: This bug is similar to 187542 and 188086. I found that also Array.prototype.push is exploitable. Tested on: Brave 0.12.12 Steps To Reproduce: 1. Go to this page: https://vulnerabledoma.in/brave/settingschange3.html Array.prototype.push=functione this0=functione,f...

CVE-2016-5208

Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5204

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

Brave Software: Sending arbitrary IPC messages via overriding Function.prototype.apply

Summary: Brave Browser allows to overwrite the internal js code from the user js code. Using this behavior, an attacker can send arbitrary IPC messages and do UXSS, address bar spoofing, changing browser settings and so on. This bug is similar to 187542. Tested on: Brave 0.12.11 Steps To Reproduc...

CVE-2016-5208

Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5204

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

Brave Software: Brave Browser unexpectedly allows to send arbitrary IPC messages

Summary: I found that Brave Browser allows to overwrite the internal js code from the user js code. Using this behavior, an attacker can send arbitrary IPC messages and do UXSS, address bar spoofing, changing browser settings and so on. Steps to Reproduce: 1 . An attacker overwrites...

Chrome the improper use of Flash message loop leads to the UXSS Vulnerability, CVE-2016-1631）

Author: Avfisher@network sharp knife 0x00 Preface This writing comes from a few days ago a buddy sent me a bug link to let the author help explain the vulnerability principle, in order to facilitate the partner understanding and left notes for future reference and then write this article. This...

CVE-2016-5181

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages...

CVE-2016-5191

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages, as demonstrated by an interpretation confli...

CVE-2 0 1 6-4 7 5 8:for Safari browser UXSS vulnerability analysis-vulnerability warning-the black bar safety net

! Foreword In this article, I'm ready to share with you about Vulnerability CVE-2 0 1 6-4 7 5 8 details. This vulnerability is a Safari in a UXSS vulnerability. The so-called UXSS, i.e., a universal cross-site scripting attacks. Currently, Apple has in Safari 1 0. fixes this vulnerability. The...