CVE-2023-49001

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/actuator/com.gurry.kvbrowser/blob/main/CWE-94.mdBroken Link
https://github.com/actuator/cve/blob/main/CVE-2023-49001Third Party Advisory
https://github.com/actuator/com.gurry.kvbrowser/blob/main/CWE-94.mdBroken Link
https://github.com/actuator/cve/blob/main/CVE-2023-49001Third Party Advisory

Timeline

Published: Dec 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490027.5An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via CVE-2023-490035.3An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simple CVE-2023-490049.8An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter.CVE-2023-490066.5Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a c CVE-2023-490079.8In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd.CVE-2023-49014.3Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI v CVE-2023-49024.3Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted H CVE-2023-490285.4Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the user CVE-2023-490296.1Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the nama CVE-2023-49034.3Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof sec CVE-2023-490307.5SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted scrip CVE-2023-490315.1Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to rea