PT-2021-7164 · Yandex · Yandex Browser For Android

Kirtikumar Anandrao Ramchandani · Published 2021-09-13 · Updated 2021-09-22 · CVE-2020-27969

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yandex Browser for Android version 20.8.4

Description The issue is related to shortcomings in the data source confirmation mechanism, allowing remote attackers to bypass the Same-Origin Policy (SOP) and spoof the address bar. This can enable a remote attacker to fake the content of the address bar.

Recommendations For Yandex Browser for Android version 20.8.4, update to a newer version to mitigate the risk of SOP bypass and address bar spoofing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2022-03582

CVE-2020-27969

Affected Products

Yandex Browser For Android

References · 6

• https://yandex.com/bugbounty/i/hall-of-fame-browser · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03582 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27969 · Security Note
• https://vuldb.com/?id.182495 · Note
• https://t.me/cibsecurity/28711 · Telegram Post