CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.3. See the original NVD description below for full technical details.
CVE
CVE-2018-15669
Severity
MEDIUM
CVSS
5.3
EPSS
0.88%
Original NVD Description
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter.
Related CVEs
Other vulnerabilities affecting the same vendor(s)