Is CVE-2020-6506 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-6506 being exploited in the wild.

How severe is CVE-2020-6506?

Low severity, with a CVSS score of 3.1, published 2 October 2020.

Which products and versions are affected?

Google WebView < 83.0.4103.106; react-native-webview (npm) SEMVER:introduced=0,fixed=11.0.0.

Is there a fix for CVE-2020-6506?

Yes. react-native-webview (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-6506 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2020-6506?

Check whether you run Google WebView or react-native-webview (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-6506: Google Android WebView Universal Cross-site Scripting

Q: Which products and versions are affected?

Google WebView < 83.0.4103.106; react-native-webview (npm) SEMVER:introduced=0,fixed=11.0.0.

Q: Is there a fix for CVE-2020-6506?

Yes. react-native-webview (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-6506 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2020-6506?

Check whether you run Google WebView or react-native-webview (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-6506 · Severity: low · CVSS 3.1 · Published 2020-10-02

A vulnerability in the Android WebView component—a tool used by mobile apps to display web content—could allow malicious websites to bypass security boundaries. If an affected app allows navigation to untrusted websites, a malicious site could execute unauthorized scripts within the app's context, potentially leading to data manipulation or unauthorized actions. Users are protected by updating their Android System WebView via the Google Play Store.

Technologies: Google WebView. Vendors: Google, npm.

Quick answers

Is CVE-2020-6506 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-6506 being exploited in the wild.
How severe is CVE-2020-6506?: Low severity, with a CVSS score of 3.1, published 2 October 2020.
Which products and versions are affected?: Google WebView < 83.0.4103.106; react-native-webview (npm) SEMVER:introduced=0,fixed=11.0.0.
Is there a fix for CVE-2020-6506?: Yes. react-native-webview (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-6506 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2020-6506?: Check whether you run Google WebView or react-native-webview (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

react-native-webview (npm): upgrade to 11.0.0 or later
```
npm install react-native-webview@11.0.0
```

Technical details

A universal cross-site scripting (UXSS) vulnerability exists in the Android WebView system component due to insufficient policy enforcement. The flaw allows a remote attacker to bypass site isolation via a crafted HTML page, specifically enabling cross-origin iframes to execute arbitrary JavaScript in the context of the top-level document. This affects any Android application using WebView versions prior to 83.0.4103.106, including React Native apps using 'react-native-webview'. The issue is resolved by updating the system WebView component to version 83.0.4103.106 or higher; 'react-native-webview' also introduced a mitigation prop in version 11.0.0.

Affected products

Google WebView < 83.0.4103.106
React Native Community react-native-webview <= 10.10.2

Identifiers

CVE-2020-6506
GHSA-36j3-xxf7-4pqg

Timeline

2020-06-15: patched: Chrome/WebView 83.0.4103.106 released
2020-07-22: advisory: NVD published CVE-2020-6506
2020-11-24: patched: react-native-webview version 11.0.0 released with mitigation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.