Philipp Beer

**Name of the Vulnerable Software and Affected Versions** Google Chrome on Android versions prior to 135.0.7049.52 **Description** The issue is related to an inappropriate implementation in Custom Tabs, allowing a remote attacker to perform privilege escalation via a crafted app if the user is convinced to engage in specific UI gestures. **Recommendations** For versions prior to 135.0.7049.52, update to version 135.0.7049.52 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 136 **Description** The Custom Tabs feature in Android apps can load web pages and supports a transition animation. This animation could be used to deceive users into granting sensitive permissions by concealing what they are actually clicking. **Recommendations** For versions prior to 136, update to version 136 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 115.0.5790.98 **Description** The issue is related to an inappropriate implementation in Custom Tabs in Google Chrome on Android, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to incorrectly implemented security checks for standard elements, potentially enabling a remote attacker to access confidential information. **Recommendations** For versions prior to 115.0.5790.98, update to version 115.0.5790.98 or later to resolve the issue. As a temporary workaround, consider restricting access to Custom Tabs until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 108.0.5359.71 Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient validation of untrusted input in CORS, allowing a remote attacker to bypass the same origin policy via a crafted HTML page. This could potentially enable an attacker to perform actions that would normally be restricted by the same origin policy. **Recommendations** For Google Chrome versions prior to 108.0.5359.71, update to version 108.0.5359.71 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.