CVE-2020-16873: Xamarin.Forms Spoofing Vulnerability
<p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.</p> <p>For the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.</p> <p>The security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.</p>
Other sources
A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106, aka 'Xamarin.Forms Spoofing Vulnerability'.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-16873?
CVE-2020-16873 is classified as a moderate severity spoofing vulnerability.
How do I fix CVE-2020-16873?
To mitigate CVE-2020-16873, update to the latest version of Microsoft Xamarin.Forms and ensure Android WebView is version 83.0.4103.106 or later.
What systems are affected by CVE-2020-16873?
CVE-2020-16873 affects Microsoft Xamarin.Forms when used in conjunction with outdated Android WebView versions.
What kind of attack can exploit CVE-2020-16873?
CVE-2020-16873 can be exploited to execute arbitrary JavaScript code on vulnerable systems.
Is there a specific version of Android WebView that addresses CVE-2020-16873?
Yes, Android WebView version 83.0.4103.106 and later are not vulnerable to CVE-2020-16873.