Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initi

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• yandex yandex browserbefore 16.10.0.2357

Versions reported by the vendor

Affected version ranges reported by the assigning authority (yandex). Independent of NVD's CPE analysis and usually ahead of it.

• Yandex N.V. Yandex Browser for iOS

  • before 16.10.0.2357 for iOSaffected

Other highest-scoring records for the same primary product.

• CVE-2021-25255Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
  33Monitor
• CVE-2024-6473DLL Hijacking in Yandex Browser
  33Monitor
• CVE-2021-25254Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
  32Monitor
• CVE-2022-28226Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary
  31Monitor
• CVE-2022-28225Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary
  31Monitor
• CVE-2021-25261Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.