Khiem Tran

**Name of the Vulnerable Software and Affected Versions** Firefox for Android versions prior to 153 **Description** A spoofing issue exists in Firefox for Android, which could allow an attacker to deceive users by impersonating a legitimate site or entity. **Recommendations** Update to version 153.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 visionOS versions prior to 26.5 **Description** A malicious iframe may use another website’s download settings. This issue was addressed through improved UI handling. **Recommendations** Update iOS to version 26.5. Update iPadOS to version 26.5. Update macOS Tahoe to version 26.5. Update visionOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 132.0.6834.83 Microsoft Edge (affected versions not specified) **Description** The issue exists due to inadequate protection of the web page structure in the Navigation function of the browsers. This could allow a remote attacker to escalate privileges using a specially crafted HTML page. The severity of this issue is considered low by Chromium. **Recommendations** For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 116.0.5845.96 **Description** The issue is related to an inappropriate implementation in Fullscreen in Google Chrome on Android, which allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could be achieved by exploiting a vulnerability related to improperly implemented security checks for standard elements. **Recommendations** For versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider restricting access to the Fullscreen feature in Google Chrome on Android until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to a security feature bypass in Microsoft Edge, allowing a remote attacker to bypass security restrictions by loading a malicious web page or file. This is due to the lack of blocking tags when loading sites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.5 iPadOS versions prior to 16.5 watchOS versions prior to 9.5 tvOS versions prior to 16.5 macOS Ventura versions prior to 13.4 **Description** The issue allows a person with physical access to a device to view contact information from the lock screen. This is possible due to inadequate checks, which have been improved to address the issue. **Recommendations** For iOS versions prior to 16.5, update to iOS 16.5 or later. For iPadOS versions prior to 16.5, update to iPadOS 16.5 or later. For watchOS versions prior to 9.5, update to watchOS 9.5 or later. For tvOS versions prior to 16.5, update to tvOS 16.5 or later. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 **Description** The issue allows a website to potentially track sensitive user information due to inadequate error handling. This could reveal sensitive information. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 111 **Description** The issue is related to insufficient access control in Mozilla Firefox. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information when a specially crafted document is opened. If temporary permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. **Recommendations** For versions prior to 111, update to version 111 or later to resolve the issue. As a temporary workaround, consider restricting the use of file: URL loaded documents in the same tab to minimize the risk of exploitation. Avoid granting temporary permissions to documents from untrusted sources.

**Name of the Vulnerable Software and Affected Versions** Apple tvOS versions prior to 15.4 Apple iOS versions prior to 15.4 Apple iPadOS versions prior to 15.4 Apple macOS Monterey versions prior to 12.3 Apple watchOS versions prior to 8.5 **Description** The issue allows a malicious application to bypass certain Privacy preferences due to inadequate permissions logic. **Recommendations** For Apple tvOS versions prior to 15.4, update to tvOS 15.4 or later. For Apple iOS versions prior to 15.4, update to iOS 15.4 or later. For Apple iPadOS versions prior to 15.4, update to iPadOS 15.4 or later. For Apple macOS Monterey versions prior to 12.3, update to macOS Monterey 12.3 or later. For Apple watchOS versions prior to 8.5, update to watchOS 8.5 or later.