Description (CNA)
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509
- https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595
- https://github.com/fivex3/CVE-2023-27035
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.