Insufficient Policy Enforcement in NFC in Google Chrome for Android

Executive Summary

This vulnerability is due to insufficient policy enforcement in the Near Field Communication (NFC) feature of Google Chrome on Android. A remote attacker could exploit it by tricking a user into visiting a crafted HTML page, which could then leak cross-origin data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Google Chrome on Android versions prior to 151.0.7922.72. Detection involves checking the installed Chrome version. On Android, go to Settings > Apps > Chrome and verify the version number. If it is below 151.0.7922.72, the system is vulnerable. No direct commands are provided for network detection as this is a client-side issue.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to access or leak sensitive data from other websites you visit while using Chrome on Android. This might include personal information or login credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves insufficient policy enforcement in NFC in Google Chrome on Android, allowing a remote attacker to leak cross-origin data via a crafted HTML page. While the vulnerability itself does not directly impact compliance with standards like GDPR or HIPAA, data leaks could potentially lead to unauthorized access to sensitive information, which may violate privacy regulations if such data includes personally identifiable information (PII) or protected health information (PHI).

Useful 0 Not Useful 0

Mitigation Strategies

Update Google Chrome on Android to version 151.0.7922.72 or later to address the insufficient policy enforcement in NFC.

Useful 0 Not Useful 0