Darknavy

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update to iOS 18.7.9 Update to iOS 26.5 Update to iPadOS 18.7.9 Update to iPadOS 26.5 Update to macOS Tahoe 26.5 Update to tvOS 26.5 Update to visionOS 26.5 Update to watchOS 26.5

**Name of the Vulnerable Software and Affected Versions** Fingerprint trustlet versions prior to SMR May-2025 Release 1 **Description** The issue is related to improper logging in the fingerprint trustlet, allowing local privileged attackers to obtain a `hmac key`. This can be exploited by attackers with local privileges. **Recommendations** For versions prior to SMR May-2025 Release 1, update to SMR May-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the fingerprint trustlet to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Fingerprint trustlet versions prior to SMR May-2025 Release 1 **Description** The issue is an out-of-bounds read in the fingerprint trustlet, allowing local privileged attackers to read out-of-bounds memory. **Recommendations** For versions prior to SMR May-2025 Release 1, update to SMR May-2025 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Fingerprint trustlet versions prior to SMR May-2025 Release 1 **Description** The issue is related to improper access control in the fingerprint trustlet, allowing local privileged attackers to obtain an `auth token`. This can be exploited by attackers with local access and privileges. **Recommendations** For versions prior to SMR May-2025 Release 1, update to SMR May-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the fingerprint trustlet to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keymaster trustlet versions prior to SMR May-2025 Release 1 **Description** The issue is an out-of-bounds write in the Keymaster trustlet, allowing local privileged attackers to write out-of-bounds memory. This can be exploited by local privileged attackers. **Recommendations** For versions prior to SMR May-2025 Release 1, update to SMR May-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Keymaster trustlet to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft OpenSSH for Windows (affected versions not specified) **Description** The issue is related to a configuration vulnerability in the OpenSSH service for Windows, specifically with the `-Oallow-remote-pkcs11` option for the ssh-agent cryptographic protection tool. This vulnerability is associated with incorrect external management of a file name or path, allowing a remote attacker to execute arbitrary code by loading a malicious DLL library. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 130.0.6723.58 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the Artificial Intelligence (AI) technology of Google Chrome and Microsoft Edge browsers. This vulnerability can be exploited by a remote attacker via a crafted HTML page, potentially allowing them to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with heap corruption. **Recommendations** For Google Chrome versions prior to 130.0.6723.58, update to version 130.0.6723.58 or later. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to AI-related features in Microsoft Edge until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 123.0.6312.122 **Description** The issue is related to out of bounds memory access in Compositing, allowing a remote attacker who has compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. This could enable the attacker to execute arbitrary code using a specially crafted web page. **Recommendations** For Google Chrome versions prior to 123.0.6312.122, update to version 123.0.6312.122 or later to resolve the issue. As a temporary workaround, consider restricting access to the Compositing component until a patch is applied. Avoid using specific UI gestures that could trigger the vulnerable code.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 119.0.6045.105 **Description** The issue is related to insufficient data validation in USB in Google Chrome, allowing a remote attacker to perform out of bounds memory access via a crafted HTML page. This could potentially enable the attacker to execute arbitrary code. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 119.0.6045.105, update to version 119.0.6045.105 or later to resolve the issue. As a temporary workaround, consider restricting access to USB interfaces in Google Chrome until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 119.0.6045.105 **Description** The issue is related to an integer overflow in the USB interface of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to execute arbitrary code. The severity of this issue is classified as High by Chromium. **Recommendations** For Google Chrome versions prior to 119.0.6045.105, update to version 119.0.6045.105 or later to resolve the issue. As a temporary workaround, consider restricting access to USB interfaces in Google Chrome until a patch is applied. Avoid using specially crafted HTML pages that could exploit the integer overflow in the USB interface.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 118.0.5993.70 **Description** The issue is related to a use after free vulnerability in the Cast component of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page to potentially compromise the renderer process and exploit heap corruption. **Recommendations** For versions prior to 118.0.5993.70, update to version 118.0.5993.70 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cast component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 116.0.5845.179 **Description** The issue is related to an out of bounds memory access in the FedCM component of Google Chrome, allowing a remote attacker who has compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. This can potentially lead to the execution of arbitrary code. The severity of this issue is classified as High by Chromium security. **Recommendations** For Google Chrome versions prior to 116.0.5845.179, update to version 116.0.5845.179 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied.