Abdulrahman Alqabandi

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 16.1 tvOS versions prior to 16.1 macOS Ventura versions prior to 13 watchOS versions prior to 9.1 iOS versions prior to 16.1 iPadOS versions prior to 16.1 WebKitGTK (affected versions not specified) WPE WebKit (affected versions not specified) **Description** A logic issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information. The issue is related to errors in state management in WebKitGTK and WPE WebKit modules, which can allow an attacker to access confidential data. **Recommendations** For Safari version prior to 16.1, update to Safari 16.1 or later. For tvOS version prior to 16.1, update to tvOS 16.1 or later. For macOS Ventura version prior to 13, update to macOS Ventura 13 or later. For watchOS version prior to 9.1, update to watchOS 9.1 or later. For iOS version prior to 16.1, update to iOS 16.1 or later. For iPadOS version prior to 16.1, update to iPadOS 16.1 or later. For WebKitGTK and WPE WebKit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 8.2 **Description** The issue is related to a Use After Free vulnerability in the Vim text editor, specifically with the `find pattern in path` function. This vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `find pattern in path` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 101.0.4951.41 Microsoft Edge (affected versions not specified) **Description** The issue is related to an inappropriate implementation in input handling, allowing a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of data. **Recommendations** For Google Chrome versions prior to 101.0.4951.41, update to version 101.0.4951.41 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 97 Thunderbird versions prior to 91.6 Firefox ESR versions prior to 91.6 **Description** The issue is related to the drag and drop function of images in the browser, which can be exploited to run arbitrary code. If a user is convinced to drag and drop an image to their desktop or other folder, the resulting object could be changed into an executable script. This would allow a remote attacker to execute arbitrary code after the user clicks on it. **Recommendations** For Firefox versions prior to 97, update to version 97 or later to resolve the issue. For Thunderbird versions prior to 91.6, update to version 91.6 or later to resolve the issue. For Firefox ESR versions prior to 91.6, update to version 91.6 or later to resolve the issue. As a temporary workaround, consider avoiding the drag and drop of images to the desktop or other folders until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 97.0.4692.99 **Description** The issue is related to a heap buffer overflow in the DevTools component of Google Chrome, which could potentially allow an attacker to exploit heap corruption. This could happen if an attacker convinces a user to install a malicious extension and the user visits a crafted HTML page. The exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** For Google Chrome versions prior to 97.0.4692.99, update to version 97.0.4692.99 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to trusted sources and avoiding the use of potentially malicious HTML pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 100.0.4896.60 **Description** The issue is related to a use after free in the Cast UI, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Google Chrome versions prior to 100.0.4896.60, update to version 100.0.4896.60 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 96.0.4664.93 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free in developer tools, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page, allowing for arbitrary code execution or denial of service. **Recommendations** For Google Chrome versions prior to 96.0.4664.93, update to version 96.0.4664.93 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 92.0.4515.107 **Description** The issue is related to an inappropriate implementation in Compositing, allowing a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could lead to unauthorized access to protected information. **Recommendations** For versions prior to 92.0.4515.107, update to version 92.0.4515.107 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 91.0.4472.101 **Description** The issue is related to a use after free in the Autofill component of Google Chrome, which can be exploited by a remote attacker using a crafted HTML page. This could potentially lead to heap corruption, allowing the attacker to access confidential data, compromise data integrity, or cause a denial of service. **Recommendations** For Google Chrome versions prior to 91.0.4472.101, update to version 91.0.4472.101 or later to resolve the issue. As a temporary workaround, consider disabling the Autofill feature until a patch is available. Restrict access to untrusted HTML pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 90.0.4430.93 **Description** The issue is related to a use after free in Dev Tools, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could potentially lead to arbitrary code execution. **Recommendations** For Google Chrome versions prior to 90.0.4430.93, update to version 90.0.4430.93 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 89.0.4389.114 Description: The issue is related to a heap buffer overflow in the TabStrip component of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This might enable the attacker to execute arbitrary code or cause a denial of service. Recommendations: For Google Chrome versions prior to 89.0.4389.114, update to version 89.0.4389.114 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 89.0.4389.72 **Description** The issue is related to insufficient policy enforcement in the Autofill component of Google Chrome, which can be exploited by a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This is due to weaknesses in the authentication procedure. **Recommendations** For versions prior to 89.0.4389.72, update to version 89.0.4389.72 or later to resolve the issue. As a temporary workaround, consider disabling the Autofill feature until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 89.0.4389.90 Description: The issue is related to a heap buffer overflow in the implementation of the "Tab Groups" extension in Google Chrome. This can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption. Recommendations: For versions prior to 89.0.4389.90, update to version 89.0.4389.90 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 88.0.4324.182 **Description** A heap buffer overflow in the Tab Strip of Google Chrome allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This issue can lead to the execution of arbitrary code. **Recommendations** For versions prior to 88.0.4324.182, update to version 88.0.4324.182 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 89.0.4389.72 **Description** The issue is related to a use after free in the tab search function, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This may potentially lead to unauthorized access to confidential information or cause a denial of service. **Recommendations** For versions prior to 89.0.4389.72, update to version 89.0.4389.72 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages that could trigger the exploitation of heap corruption until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 90.0.4430.72 Microsoft Edge (affected versions not specified) Description: The issue is related to the improper implementation of security checks for standard elements in the Autofill feature of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to gain unauthorized access to protected information using a specially crafted web page. The attacker can spoof security UI via a crafted HTML page. Recommendations: For Google Chrome versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 90.0.4430.72 Microsoft Edge (affected versions not specified) Description: The issue is related to the improper implementation of security checks for standard elements in the Autofill feature of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to gain unauthorized access to protected information using a specially crafted web page. The attacker can spoof security UI via a crafted HTML page. Recommendations: For Google Chrome versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 85 **Description** The issue is related to an ambiguous file picker design that could confuse users into uploading a whole directory instead of a single file. This could potentially allow a remote attacker to gain unauthorized access to protected information due to errors in the user interface's representation of information. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided. **Recommendations** For versions prior to 85, update to version 85 or later to address the issue. As a temporary workaround, consider using caution when selecting files for upload to avoid inadvertently uploading entire directories until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 83 Firefox ESR versions prior to 78.5 Thunderbird versions prior to 78.5 **Description** The issue allows the browser to enter fullscreen mode without displaying the security UI, making it possible to attempt a phishing attack or otherwise confuse the user. **Recommendations** For Firefox versions prior to 83, update to version 83 or later. For Firefox ESR versions prior to 78.5, update to version 78.5 or later. For Thunderbird versions prior to 78.5, update to version 78.5 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 86.0.4240.75 **Description** The issue is related to an inappropriate implementation in Blink, which is a part of Google Chrome. This allowed a remote attacker to spoof security UI via a crafted HTML page. The vulnerability is associated with errors in the implementation of security checks for standard elements, potentially enabling a remote attacker to conduct spoofing attacks. **Recommendations** For versions prior to 86.0.4240.75, update to version 86.0.4240.75 or later to resolve the issue.