Hafiizh

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 153 **Description** A clickjacking issue exists in the WebExtensions component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. **Recommendations** Update to version 153.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** An issue exists where the user interface misrepresents critical information, which could allow an unauthorized attacker to perform spoofing over a network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 150.0.7871.46 **Description** An issue in the WebAppInstalls component allows a remote attacker to perform UI spoofing by using a specially crafted HTML page. UI spoofing is a technique where an attacker mimics a legitimate user interface to deceive users into performing unintended actions. **Recommendations** Update Google Chrome to version 150.0.7871.46 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 151 Firefox ESR versions prior to 140.11 Thunderbird versions prior to 151 Thunderbird versions prior to 140.11 **Description** A spoofing issue exists within the Form Autofill component. **Recommendations** Update to version 151 Update to version 140.11 Update to version 151 Update to version 140.11

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Thunderbird versions prior to 148 **Description** A spoofing issue exists in the WebAuthn component in Firefox for Android. This issue affects Firefox and Thunderbird. **Recommendations** Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 145.0.7632.45 **Description** An improper implementation in the Downloads feature allows a remote attacker to perform UI spoofing through a specially crafted HTML page. The Chromium security severity is rated as Low. **Recommendations** Update Google Chrome to version 145.0.7632.45 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 149.0.7827.53 **Description** Incorrect security UI in the Tab Strip allows a remote attacker to perform domain spoofing, which is the act of disguising a website to appear as a different, trusted domain, by using a crafted HTML page. **Recommendations** Update to version 149.0.7827.53 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome (affected versions not specified) **Description** A flaw exists in the Digital Credentials component of the Google Chrome browser due to improper restriction of rendered user interface layers. Remote attackers may be able to compromise the integrity of protected information by exploiting this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 149.0.7827.53 **Description** Incorrect security UI in Tab Hover Cards allows a remote attacker to perform domain spoofing by using a crafted domain name. **Recommendations** Update to version 149.0.7827.53 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 143 Thunderbird versions prior to 143 **Description** The software contains a flaw. **Recommendations** Update Firefox to version 143 or later. Update Thunderbird to version 143 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome (affected versions not specified) **Description** A flaw exists in the Split View component of the Google Chrome browser related to errors in how information is presented in the user interface. Remote exploitation of this issue could allow an attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 142 Focus for iOS versions prior to 142 Description: Malicious pages could exploit Firefox for iOS to pass FIDO links to the operating system, triggering the hybrid passkey transport. An attacker within Bluetooth range could potentially trick a user into using their passkey to log the attacker’s computer into the target account. Recommendations: Update Firefox for iOS to version 142 or later. Update Focus for iOS to version 142 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider being cautious when granting exceptions for websites, especially when accessing them via HTTP, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 138 Thunderbird versions prior to 138 **Description** A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This issue affects Firefox for Android and Thunderbird. **Recommendations** For Firefox for Android versions prior to 138, update to version 138 or later to resolve the issue. For Thunderbird versions prior to 138, update to version 138 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 136 Firefox ESR versions prior to 128.8 **Description** A web page could trick a user into setting that site as the default handler for a custom URL protocol. **Recommendations** For Firefox versions prior to 136, update to version 136 or later. For Firefox ESR versions prior to 128.8, update to version 128.8 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 132.0.6834.83 Microsoft Edge versions (affected versions not specified) **Description** The issue is related to a race condition in the Frames component of Google Chrome and Microsoft Edge, allowing a remote attacker to bypass authentication through spoofing. This can be achieved by convincing a user to perform specific UI gestures, enabling the attacker to perform UI spoofing via a crafted HTML page. **Recommendations** For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 132.0.6834.83 Microsoft Edge (affected versions not specified) **Description** The issue is related to an inappropriate implementation in the Extensions component of Google Chrome and Microsoft Edge, allowing a remote attacker to perform UI spoofing via a crafted Chrome Extension. This can be achieved by convincing a user to engage in specific UI gestures. The exploitation of this issue may allow an attacker to bypass existing security restrictions and perform a user interface spoofing attack. **Recommendations** For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 132 Firefox ESR versions prior to 128.4 Thunderbird versions prior to 128.4 Thunderbird versions prior to 132 **Description** The issue is related to the truncation of long URLs, which could allow origin spoofing in permission prompts. This may enable a remote attacker to impact data integrity through authentication bypass via spoofing. **Recommendations** For Firefox versions prior to 132, update to version 132 or later. For Firefox ESR versions prior to 128.4, update to version 128.4 or later. For Thunderbird versions prior to 128.4, update to version 128.4 or later. For Thunderbird versions prior to 132, update to version 132 or later.

Name of the Vulnerable Software and Affected Versions: Microsoft Edge (Chromium-based) versions up to 129.0.2792.52 Description: A spoofing issue is present in Microsoft Edge, related to errors in user interface information representation. This could allow a remote attacker to conduct spoofing attacks. Recommendations: For versions up to 129.0.2792.52, upgrade the affected component immediately to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 131 **Description** A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This issue may allow a remote attacker to conduct spoofing attacks. The vulnerability only affects Firefox for Android, while other versions of Firefox are unaffected. **Recommendations** For Firefox for Android versions prior to 131, update to version 131 or later to resolve the issue. As a temporary workaround, consider being cautious when downloading files with unusual filenames to minimize the risk of exploitation.