Skip to main content

Yandex Browser CVE-2021-25262

MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2025-05-21 browser-security@yandex-team.ru
Google Information Disclosure Yandex Browser Android
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:43 vuln.today
CVE Published
May 21, 2025 - 07:16 nvd
MEDIUM 6.9

DescriptionCVE.org

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

AnalysisAI

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-116. Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. Affected products include: Yandex Yandex Browser. Version information: version 21.3.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Yandex Browser

View all
CVE-2021-25255 HIGH
8.3 May 21

Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. Rated high
CVE-2024-6473 HIGH
8.4 Sep 03

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVE-2020-7369 MEDIUM POC
4.3 Oct 20

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser all
CVE-2021-25254 HIGH
8.2 May 21

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. Rated high severity (CVS
CVE-2022-28226 HIGH
7.8 Jun 15

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker
CVE-2022-28225 HIGH
7.8 Jun 15

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker
CVE-2021-25263 HIGH
7.8 Aug 17

Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker
CVE-2023-26226 HIGH
7.4 May 30

A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682. Rated high se
CVE-2016-8503 HIGH
7.3 Oct 26

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote att
CVE-2016-8502 HIGH
7.3 Oct 26

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote

CVE-2016-8507 MEDIUM
6.5 Mar 01

Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remot
CVE-2016-8508 MEDIUM
6.5 Mar 01

Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-25262 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy