Muneaki Nishimura

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 152.0 **Description** Firefox for iOS used partial domain matching when attaching cookies to PDF requests. This behavior allows a malicious site hosted on a suffix domain to receive cookies belonging to the target site, leading to cookie leakage. **Recommendations** Update to version 152.0.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 152.0 **Description** Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument. This behavior allows a malicious site to inject arbitrary cookies into requests directed to an unrelated target domain. **Recommendations** Update to version 152.0.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 151.2 **Description** Reader View in Firefox for iOS replaced page content in its HTML template before substituting other internal placeholders. A malicious page could include a placeholder string that was subsequently replaced with JSON-LD (JavaScript Object Notation for Linked Data, a format for describing structured data) data, which could lead to arbitrary JavaScript execution. **Recommendations** Update to version 151.2.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 151.2 **Description** Reader View fails to properly escape HTML tags within JSON-LD metadata. This allows a malicious page to inject markup that alters Reader View behavior and leaks sensitive URL parameters. Such leaked parameters could be utilized to access internal pages, which may lead to arbitrary JavaScript execution within an internal origin. **Recommendations** Update to version 151.2.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 151.0 **Description** Reader mode was hosted on an unauthenticated local web server. This allows another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. **Recommendations** Update to version 151.0.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 143.1 **Description** A flaw existed in how Firefox for iOS handled cookie storage for non-HTML temporary documents. This resulted in incorrect sharing of cookie storage between non-HTML temporary documents and normal browsing content. Consequently, information from private tabs could potentially leave Incognito mode, even after all tabs were closed. **Recommendations** Update to Firefox for iOS version 143.1 or later.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 14.2 Description: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in cross-site scripting (XSS) attacks. Recommendations: Update Focus for iOS to version 14.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 127 **Description** The issue is related to errors in the representation of information by the user interface. It may allow a remote attacker to conduct spoofing attacks using the ` cpLocation` attribute, potentially misleading users about the actual website address. A malicious website could attempt to display a fake location URL bar. **Recommendations** For Firefox for iOS versions prior to 127, update to version 127 or later to resolve the issue. As a temporary workaround, consider being cautious when clicking on links from untrusted sources and verify the actual website address in the URL bar to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 124 **Description** The issue is related to insufficient input validation when dragging URL addresses into the address bar, allowing a remote attacker to bypass security restrictions and load arbitrary pages. This can be achieved by dragging Javascript URLs to the address bar, which could cause them to be loaded and bypass security protections. **Recommendations** For Firefox for iOS versions prior to 124, update Firefox to a version 124 or later to resolve the issue. As a temporary workaround, consider avoiding dragging URLs into the address bar until the update is applied. Restrict access to suspicious links to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 123.0.6312.58 **Description** The issue is related to incorrect security UI in Google Chrome, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This can be achieved by exploiting the incorrect limitation of visualized UI layers. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 123.0.6312.58, update to version 123.0.6312.58 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted HTML pages to minimize the risk of exploitation. Avoid using Google Chrome for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 123 **Description** An attacker could execute unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. **Recommendations** For Firefox for iOS versions prior to 123, update to version 123 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom Firefox schemes when opening external URLs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 123 **Description** An issue allows an attacker to execute JavaScript from an opened bookmarked page when using an AMP url with a canonical element. **Recommendations** For versions prior to 123, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 121.0.6167.85 **Description** The issue is related to incorrect security UI in Payments, allowing a remote attacker to potentially spoof security UI via a crafted HTML page. This could enable the attacker to bypass security restrictions. The severity of this issue is classified as Medium. **Recommendations** For Google Chrome versions prior to 121.0.6167.85, update to version 121.0.6167.85 or later to resolve the issue. As a temporary workaround, consider restricting access to the Payments component until a patch is applied. Avoid using crafted HTML pages that could exploit this issue.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 120 **Description** The issue is related to the Reader Mode in Firefox for iOS, where the browser fails to neutralize HTML tags, allowing an attacker to perform HTML template injection. This could enable a remote attacker to gain unauthorized access to protected information and conduct cross-site scripting attacks. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 120, update to version 120 or later to resolve the issue. As a temporary workaround, consider disabling the Reader Mode feature until a patch is available. Restrict access to sensitive information when using the affected browser version to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 120 **Description** The issue is related to insufficient access control due to key filtering via the `referrerpolicy` attribute in Reader Mode. This could allow a remote attacker to elevate their privileges by ex-filtrating a security key. **Recommendations** For versions prior to 120, update to version 120 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 120 **Description** The issue is related to the HTTPS-only mode in Firefox, where an attacker could trick a user into granting an HTTPS-only exception by getting them to participate in a clicking game, if the user had enabled HTTPS-only mode and was loading an insecure HTTP page. This could allow a remote attacker to conduct a clickjacking attack by exploiting errors in the user interface's information presentation. **Recommendations** For versions prior to 120, update to version 120 or later to resolve the issue. As a temporary workaround, consider avoiding participation in clicking games or other interactive elements when loading insecure HTTP pages in HTTPS-only mode. Restrict access to insecure HTTP pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 102 **Description** The issue is related to the handling of HTTP requests, which could allow a remote attacker to bypass existing security restrictions and disclose protected information using the HTTP referer header. This is due to the potential leak of a secret UUID key through the Referrer header. **Recommendations** For Firefox for iOS versions prior to 102, update to version 102 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 101 **Description** The issue is related to a lack of protection against SQL query structure exploitation. This could allow a remote attacker to send specially crafted data to the application, potentially executing arbitrary SQL commands. The search term could be specified externally to trigger SQL injection. **Recommendations** For versions prior to 101, update to version 101 or later to resolve the issue. As a temporary workaround, consider restricting access to external search terms to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome on iOS versions prior to 92.0.4515.107 **Description** The issue is related to insufficient policy enforcement in image handling, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can enable the attacker to bypass security restrictions and gain unauthorized access to protected information. **Recommendations** For Google Chrome on iOS versions prior to 92.0.4515.107, update to version 92.0.4515.107 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 34 **Description** The issue is related to errors in authorization, where the client fails to differentiate between normal and private browsing modes. This leads to the sharing of private mode cookies in normal browsing mode, potentially allowing a remote attacker to gain unauthorized access to protected information. **Recommendations** For Firefox for iOS versions prior to 34, update to version 34 or later to resolve the issue. As a temporary workaround, consider avoiding the use of private browsing mode until the update is applied. Restrict access to sensitive information when using the browser in normal mode to minimize the risk of exploitation.