Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
15 versions affected across 1 product
addJavascriptInterface is catastrophically insecure. Any public method on an injected Java object (including getClass()) is callable from JavaScript, leading to full remote code execution (CVE-2012-6636, CVE-2013-4710 https://www.cve.org/CVERecord?id=CVE-2013-4710) https://t.co/SprJNSoMeh
16 of 16 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | android_api | - | - | - | |
| App | android_api | 1.0 | - | - | |
| App | android_api | 10.0 | - | - | |
| App | android_api | 11.0 | - | - | |
| App | android_api | 12.0 | - | - | |
| App | android_api | 13.0 | - | - | |
| App | android_api | 14.0 | - | - | |
| App | android_api | 15.0 | - | - | |
| App | android_api | 2.0 | - | - | |
| App | android_api | 3.0 | - | - | |
| App | android_api | 4.0 | - | - | |
| App | android_api | 5.0 | - | - | |
| App | android_api | 6.0 | - | - | |
| App | android_api | 7.0 | - | - | |
| App | android_api | 8.0 | - | - | |
| App | android_api | 9.0 | - | - |