#android

Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92.

Google has rolled out its monthly security patches for Android with fixes for 39 flaws, including a zero-day vulnerability that it said is being actively exploited in the wild in limited, targeted attacks. Tracked as CVE-2021-1048, the zero-day bug is described as a use-after-free vulnerability in the kernel that can be exploited for local privilege escalation. Use-after-free issues are

Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.

Google’s Android November 2021 security updates plug 18 flaws in the framework and system components and 18 more in the kernel and vendor components.

Google has patched 39 vulnerabilities, some of which are rated as critical and one that may be under limited, targeted exploitation. Categories: Exploits and vulnerabilities Tags: Android TV CVE-2-21-0930 CVE-2021-0889 CVE-2021-0918 CVE-2021-0930 CVE-2021-1048 CVE-2021-1924 CVSS eop heap overflow MediaTek patch levels qualcomm rce UAF *( Read more... ( https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/11/google-patches-zero-day-vulnerability-and-others-in-android/ ) )* The post Google patches zero-day vulnerability, and others, in Android appeared first on Malwarebytes Labs.

‘Shrootless’ allows bypass of System Integrity Protection IT security measures to install a malicious rootkit that goes undetected and performs arbitrary device operations.

Stolen access token leveraged in phishing campaign that spoofs brand name email addresses.

Microsoft 365 (M365), formerly called Office 365 (O365), is Microsoft's cloud strategy flagship product with major changes ahead, such as the deprecation of their legacy authentication protocols. Often stored on or saved to the device, Basic Authentication protocols rely on sending usernames and passwords with every request, increasing the risk of attackers capturing users' credentials,

A Russian national, who was arrested in South Korea last month and extradited to the U.S. on October 20, appeared in a federal court in the state of Ohio on Thursday to face charges for his alleged role as a member of the infamous TrickBot group. Court documents showed that Vladimir Dunaev, 38, along with other members of the transnational, cybercriminal organization, stole money and

A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115.