CVE-2023-27108 — n/a / n/a

Description (CNA)

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allows an attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://gist.github.com/Tombarr/5ed6675f33e0eca149a8b4d38ce76dda
https://kaios.dev/cve/1409490

ADP enrichment

CVE

No English description supplied.

https://gist.github.com/Tombarr/5ed6675f33e0eca149a8b4d38ce76dda
https://kaios.dev/cve/1409490

CISA-ADP

No English description supplied.

No references supplied.