Browser
Authentication & Access Bypass
Safari reader same origin policy (SOP) bypass
Safari reader same origin policy (SOP) bypass An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy
7.5
/ 10
High
CVSS v3.1
ADVISORY ID
PS37
PUBLISHED
2022-10-03
CVE IDs
CVE-2020-9911
VENDORS
Apple
PUBLIC EXPLOIT
None indexed
CWE
PRODUCT
Safari (macOS/iOS/iPadOS)
CVSS VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
.png)
Summary
Overview
Safari reader same origin policy (SOP) bypass
An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy
Vulnerability details
Vulnerability details
CVE-2020-9911
High | 7.5
Safari reader same origin policy (SOP) bypass An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy
Impact:
Arbitrary data or code modification
DISCLOSURE
Disclosure timeline
2020-04-19 reported to the vendor
2020-07-15 fixed released by the vendor
References
2026-06-17 (NVD record)
Credits
Nikhil Mittal
Related Advisories
jscript.dll - ActiveXObject BSTR - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-787
2022-09-27
High
Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability
Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe…
Desktop Software
Memory Corruption
CWE-125
2022-10-01
Medium
Opera Mini Location Permission Spoof
Opera Mini Location Permission Spoof Vulnerability A location permission spoof vulnerability was discovered in opera mini 47.1.2249.129326 for Android which allows an attacker to spoof location…
Browser
Spoofing
2022-10-01
Medium
Concerned about a similar issue in your product?
Payatu's researchers find these vulnerabilities before attackers do. Talk to us about product, firmware and IoT security testing.
