Hafiizh

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 151 Firefox ESR versions prior to 140.11 Thunderbird versions prior to 151 Thunderbird versions prior to 140.11 **Description** A spoofing issue exists within the Form Autofill component. **Recommendations** Update to version 151 Update to version 140.11 Update to version 151 Update to version 140.11

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Thunderbird versions prior to 148 **Description** A spoofing issue exists in the WebAuthn component in Firefox for Android. This issue affects Firefox and Thunderbird. **Recommendations** Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 145.0.7632.45 **Description** An improper implementation in the Downloads feature allows a remote attacker to perform UI spoofing through a specially crafted HTML page. The Chromium security severity is rated as Low. **Recommendations** Update Google Chrome to version 145.0.7632.45 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 149.0.7827.53 **Description** Incorrect security UI in the Tab Strip allows a remote attacker to perform domain spoofing, which is the act of disguising a website to appear as a different, trusted domain, by using a crafted HTML page. **Recommendations** Update to version 149.0.7827.53 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome (affected versions not specified) **Description** A flaw exists in the Digital Credentials component of the Google Chrome browser due to improper restriction of rendered user interface layers. Remote attackers may be able to compromise the integrity of protected information by exploiting this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 149.0.7827.53 **Description** Incorrect security UI in Tab Hover Cards allows a remote attacker to perform domain spoofing by using a crafted domain name. **Recommendations** Update to version 149.0.7827.53 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 143 Thunderbird versions prior to 143 **Description** The software contains a flaw. **Recommendations** Update Firefox to version 143 or later. Update Thunderbird to version 143 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome (affected versions not specified) **Description** A flaw exists in the Split View component of the Google Chrome browser related to errors in how information is presented in the user interface. Remote exploitation of this issue could allow an attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 142 Focus for iOS versions prior to 142 Description: Malicious pages could exploit Firefox for iOS to pass FIDO links to the operating system, triggering the hybrid passkey transport. An attacker within Bluetooth range could potentially trick a user into using their passkey to log the attacker’s computer into the target account. Recommendations: Update Firefox for iOS to version 142 or later. Update Focus for iOS to version 142 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider being cautious when granting exceptions for websites, especially when accessing them via HTTP, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 138 Thunderbird versions prior to 138 **Description** A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This issue affects Firefox for Android and Thunderbird. **Recommendations** For Firefox for Android versions prior to 138, update to version 138 or later to resolve the issue. For Thunderbird versions prior to 138, update to version 138 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 136 Firefox ESR versions prior to 128.8 **Description** A web page could trick a user into setting that site as the default handler for a custom URL protocol. **Recommendations** For Firefox versions prior to 136, update to version 136 or later. For Firefox ESR versions prior to 128.8, update to version 128.8 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 132.0.6834.83 Microsoft Edge versions (affected versions not specified) **Description** The issue is related to a race condition in the Frames component of Google Chrome and Microsoft Edge, allowing a remote attacker to bypass authentication through spoofing. This can be achieved by convincing a user to perform specific UI gestures, enabling the attacker to perform UI spoofing via a crafted HTML page. **Recommendations** For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 132.0.6834.83 Microsoft Edge (affected versions not specified) **Description** The issue is related to an inappropriate implementation in the Extensions component of Google Chrome and Microsoft Edge, allowing a remote attacker to perform UI spoofing via a crafted Chrome Extension. This can be achieved by convincing a user to engage in specific UI gestures. The exploitation of this issue may allow an attacker to bypass existing security restrictions and perform a user interface spoofing attack. **Recommendations** For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 132 Firefox ESR versions prior to 128.4 Thunderbird versions prior to 128.4 Thunderbird versions prior to 132 **Description** The issue is related to the truncation of long URLs, which could allow origin spoofing in permission prompts. This may enable a remote attacker to impact data integrity through authentication bypass via spoofing. **Recommendations** For Firefox versions prior to 132, update to version 132 or later. For Firefox ESR versions prior to 128.4, update to version 128.4 or later. For Thunderbird versions prior to 128.4, update to version 128.4 or later. For Thunderbird versions prior to 132, update to version 132 or later.

Name of the Vulnerable Software and Affected Versions: Microsoft Edge (Chromium-based) versions up to 129.0.2792.52 Description: A spoofing issue is present in Microsoft Edge, related to errors in user interface information representation. This could allow a remote attacker to conduct spoofing attacks. Recommendations: For versions up to 129.0.2792.52, upgrade the affected component immediately to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 131 **Description** A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This issue may allow a remote attacker to conduct spoofing attacks. The vulnerability only affects Firefox for Android, while other versions of Firefox are unaffected. **Recommendations** For Firefox for Android versions prior to 131, update to version 131 or later to resolve the issue. As a temporary workaround, consider being cautious when downloading files with unusual filenames to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 18 macOS versions prior to Sequoia 15 **Description** The issue was addressed with improved UI. Visiting a malicious website may lead to address bar spoofing. **Recommendations** For Safari versions prior to 18, update to Safari 18 to resolve the issue. For macOS versions prior to Sequoia 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 130 **Description** The issue is related to the notification announcing the transition to fullscreen mode in Firefox on Android. Multiple prompts and panels from both Firefox and the Android OS could be used to obscure this notification, potentially leading to spoofing of the browser UI if the user is distracted by the sudden appearance of a prompt. The notifications now use the Android Toast feature. This issue only affects Firefox on Android, with other operating systems being unaffected. **Recommendations** For versions prior to 130, update to Firefox version 130 or later to resolve the issue. As a temporary workaround, consider being cautious when multiple prompts appear, ensuring to notice any visual transitions to fullscreen mode. Restricting the use of fullscreen mode until the update can also minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 130 Firefox ESR versions prior to 128.2 Thunderbird versions prior to 128.2 **Description** The issue is related to incorrect restriction of visualized user interface layers, which could allow a remote attacker to perform spoofing attacks. If a site has permission to open popup windows, it could cause Select elements to appear on top of another site. **Recommendations** For Firefox versions prior to 130, update to version 130 or later to resolve the issue. For Firefox ESR versions prior to 128.2, update to version 128.2 or later to resolve the issue. For Thunderbird versions prior to 128.2, update to version 128.2 or later to resolve the issue.