Content Security Policy Flaw in ENS Control Browser Extension by Trellix

CVE-2024-0310

Summary

The ENS Control browser extension prior to version 10.7.0 Update 15 contains a content-security-policy vulnerability that permits remote attackers to modify the response header parameter settings. This manipulation can lead to switching the content security policy into report-only mode, which ultimately allows attackers to circumvent the established content security policy configurations. Such a vulnerability can expose users to various attacks, enabling the exploitation of potentially harmful content.

References