cve/2020/CVE-2020-16873.md

### [CVE-2020-16873](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16873)
![](https://img.shields.io/static/v1?label=Product&message=xamarin.forms&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=83.0.0%3C%20publication%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Spoofing&color=brighgreen)

### Description

<p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.</p><p>For the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.</p><p>The security update addresses this vulnerability by preventing the malicious Javascript from running in the WebView.</p>

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/404notf0und/CVE-Flow
- https://github.com/hungxtran/XF_WebViewEventsNotFired