Vulnerability · Published Mar 25, 2022 · Assigned by F-SecureUS

CVE-2021-44751F-Secure SAFE Browser vulnerable to USSD attacks

Medium 4.3

In plain English

A medium-severity security flaw in F-Secure SAFE Browser for Android Version 18.5 & below from F-Secure. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In most modern Android OS, dialer application will require user interaction, however, some older Android OS may not need user interaction.

Affected products (as reported)

Vendor	Product	Versions
F-Secure	F-Secure SAFE Browser for Android Version 18.5 & below	18.5 – before 18.6

References

https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame x_refsource_MISC