Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
14 versions affected across 1 product
addJavascriptInterface is catastrophically insecure. Any public method on an injected Java object (including getClass()) is callable from JavaScript, leading to full remote code execution (CVE-2012-6636, CVE-2013-4710 https://www.cve.org/CVERecord?id=CVE-2013-4710) https://t.co/SprJNSoMeh
14 of 14 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | android | 3.0 | - | - | |
| OS | android | 3.1 | - | - | |
| OS | android | 3.2 | - | - | |
| OS | android | 3.2.1 | - | - | |
| OS | android | 3.2.2 | - | - | |
| OS | android | 3.2.4 | - | - | |
| OS | android | 3.2.6 | - | - | |
| OS | android | 4.0 | - | - | |
| OS | android | 4.0.1 | - | - | |
| OS | android | 4.0.2 | - | - | |
| OS | android | 4.0.3 | - | - | |
| OS | android | 4.0.4 | - | - | |
| OS | android | 4.1 | - | - | |
| OS | android | 4.1.2 | - | - |