CVE-2018-15669

An issue was discovered in Bloop Airmail 3 3.5.9 for macOS

published August 21, 2018

CVSS
—
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00883 · 58.8th percentile
Published
2018-08-21T23:00Z
EPSS history
Timeline
  • 21 AUG 23:00Z
    An issue was discovered in Bloop Airmail 3 3.5.9 for macOS
    cvelistv5