| Package | Affected versions | Patched versions |
|---|---|---|
| airmail 3 | = 3.5.9 |
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free