by Kastro
Paper/Archive/CVE-2021-44749

CVE-2021-44749

F-Secure F-Secure SAFE Browser for Android Version 18.5 — Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android

EPSS 0.8%CVSS 9.6
critical.is priorityof 100
40
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 57.1.571 × 2011.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution.

Affected

ProductAffectedFixed inSource
F-Secure SAFE Browser for Android Version 18.5unspecified – < 18.5x18.5xCNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
F-SecureUS (CNA)5.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

reff-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44749