CVE-2021-44748 : Security Advisory and Response

A vulnerability affecting F-Secure SAFE browser allows remote attackers to execute JavaScript leading to universal cross-site scripting.

Understanding CVE-2021-44748

What is CVE-2021-44748?

The vulnerability in F-Secure SAFE Browser for Android allows for remote exploitation via automatic image loading, leading to JavaScript execution and cross-site scripting.

The Impact of CVE-2021-44748

The vulnerability can be used by attackers to trigger universal cross-site scripting through the browser, requiring user interaction such as visiting a malicious website.

Technical Details of CVE-2021-44748

Vulnerability Description

The flaw allows attackers to exploit automatic image loading to execute JavaScript, enabling universal cross-site scripting.

Affected Systems and Versions

F-Secure SAFE Browser for Android Version 18.5 prior to 18.5x

Exploitation Mechanism

Attack Complexity: LOW
Attack Vector: NETWORK
User Interaction: REQUIRED
Privileges Required: LOW
Availability Impact: LOW
Integrity Impact: LOW
Confidentiality Impact: LOW
Scope: UNCHANGED

Mitigation and Prevention

Immediate Steps to Take

Ensure automatic updates are enabled to receive the fix

Long-Term Security Practices

Regularly update software and enable security features
Exercise caution while browsing and avoid visiting unknown or suspicious websites

Patching and Updates

A fix has been available through automatic updates since 18th February 2022, requiring no additional user action.