{"id":"CVE-2020-16873","aliases":["EUVD-2020-8831","GHSA-mc93-wcph-m2mx"],"status":"published","title":"Xamarin.Forms Spoofing Vulnerability","description":"\u003cp\u003eA spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.\u003c/p\u003e\n\u003cp\u003eFor the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.\u003c/p\u003e\n\u003cp\u003eThe security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.\u003c/p\u003e","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C/CR:M/MAV:N/MAC:L/MPR:N/MUI:R/MS:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03973,"percentile":0.90554,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188"],"published":"2020-09-11T17:08:46Z","modified":"2026-06-17T02:58:10Z","products":[{"vendor":"microsoft","product":"xamarin.forms"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16873","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16873"},{"url":"https://github.com/advisories/GHSA-mc93-wcph-m2mx"}],"sources":{"cve":[{"id":"CVE-2020-16873","title":"Xamarin.Forms Spoofing Vulnerability","description":"\u003cp\u003eA spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.\u003c/p\u003e\n\u003cp\u003eFor the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.\u003c/p\u003e\n\u003cp\u003eThe security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.\u003c/p\u003e","status":"published","published":"2020-09-11T17:08:46Z","modified":"2024-08-04T13:45:33.227Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C/CR:M/MAV:N/MAC:L/MPR:N/MUI:R/MS:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8831","description":"\u003cp\u003eA spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.\u003c/p\u003e\n\u003cp\u003eFor the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.\u003c/p\u003e\n\u003cp\u003eThe security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.\u003c/p\u003e","status":"published","published":"2020-09-11T17:08:46Z","modified":"2024-08-04T13:45:33Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C/CR:M/MAV:N/MAC:L/MPR:N/MUI:R/MS:C","level":"medium"}],"updated_at":"2026-11-03T03:07:28.222143Z"}],"ghsa":[{"id":"GHSA-mc93-wcph-m2mx","title":"A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on...","description":"A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106, aka 'Xamarin.Forms Spoofing Vulnerability'.","status":"published","published":"2022-05-24T17:28:08Z","modified":"2024-01-01T00:30:40Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:55:19.223338Z"}],"nvd":[{"id":"CVE-2020-16873","description":"\u003cp\u003eA spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.\u003c/p\u003e\n\u003cp\u003eFor the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.\u003c/p\u003e\n\u003cp\u003eThe security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.\u003c/p\u003e","status":"published","published":"2020-09-11T17:15:17.417Z","modified":"2026-06-17T02:58:10.41Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:06:14.981587Z"}]}}