PT-2022-12202 · Duckduckgo · Duckduckgo Browser

Published 2022-03-25 · Updated 2022-03-31 · CVE-2021-44683

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions DuckDuckGo browser version 7.64.4

Description The issue is related to Address Bar Spoofing due to mishandling of the JavaScript window.open function, which is used to open a secondary browser window. This could be exploited by tricking users into supplying sensitive information, such as credentials, because the address bar would display a legitimate URL, but the content would be hosted on the attacker's web site.

Recommendations For DuckDuckGo browser version 7.64.4, consider disabling the use of the window.open function until a patch is available to prevent Address Bar Spoofing attacks.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-44683

Affected Products

Duckduckgo Browser

References · 4

• 🔥 https://cybercitadel.com/remote-address-bar-spoofing-and-html-injection-disclosures · Exploit
• https://osv.dev/vulnerability/CVE-2021-44683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44683 · Security Note
• https://t.me/cvenotify/28205 · Telegram Post