GHSA-36j3-xxf7-4pqg

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-36j3-xxf7-4pqg/GHSA-36j3-xxf7-4pqg.json
Aliases
Published
2020-10-02T16:22:41Z
Modified
2022-08-03T23:40:07Z
Details

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a react-native-webview that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

References

https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/

References

Affected packages

npm / react-native-webview

react-native-webview

Affected ranges

Type
SEMVER
Events
Introduced
0
Fixed
11.0.0

Affected versions

Database specific

{
    "last_known_affected_version_range": "<= 10.10.2"
}