CVE-2020-27969 Security feature bypass in Yandex Browser for Android
Remote attackers can bypass Same-Origin Policy and spoof the address bar in Yandex Browser for Android, misleading users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27969?
CVE-2020-27969 is a high-severity vulnerability in Yandex Browser for Android, published on 13 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing
Weakness: CWE-346
Which versions are affected by CVE-2020-27969?
It affects 1 product.
Products include Yandex Yandex Browser.
How do I fix CVE-2020-27969?
No fix has been published for CVE-2020-27969 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27969 being exploited?
There is no known exploitation of CVE-2020-27969 in the wild and no public exploit code.
Other vulnerabilities in Yandex Browser for Android
- CVE-2024-6473 DLL Hijacking in Yandex Browser
- CVE-2021-25255 Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
- CVE-2021-25254 Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
- CVE-2021-25261 Privilege escalation in Yandex Browser (Desktop)
- CVE-2022-28225 Privilege escalation in Yandex Browser (Desktop)
Sources
Also known as GHSA-vwhg-5hvv-63v5.