CVE-2014-6041 : The Android WebView in Android before 4.4 allows remote attackers to bypass the

The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.

Published 2014-09-02 10:55:05

Updated 2017-09-08 01:29:07

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2014-6041

Google » Android Browser » Version: 4.2.1 For Android
cpe:2.3:a:google:android_browser:4.2.1:*:*:*:*:android:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-6041

EPSS FAQ

90.67%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-6041

Android Browser RCE Through Google Play Store XFO

First seen: 2020-04-26

auxiliary/admin/android/google_play_store_uxss_xframe_rce

This module combines two vulnerabilities to achieve remote code execution on affected Android devices. First, the module exploits CVE-2014-6041, a Universal Cross-Site Scripting (UXSS) vulnerability present in versions of Android's open source stock browser (the AOSP

More information
Android Open Source Platform (AOSP) Browser UXSS

First seen: 2020-04-26

auxiliary/gather/android_stock_browser_uxss

This module exploits a Universal Cross-Site Scripting (UXSS) vulnerability present in all versions of Android's open source stock browser before 4.4, and Android apps running on < 4.4 that embed the WebView component. If successful, an attacker can leverage this bug

More information

CVSS scores for CVE-2014-6041

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-6041

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-6041

https://exchange.xforce.ibmcloud.com/vulnerabilities/95693

Google Android Browser security bypass CVE-2014-6041 Vulnerability Report
https://community.rapid7.com/community/metasploit/blog/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041

Major Android Bug is a Privacy Disaster (CVE-2014-6041)
http://www.securityfocus.com/bid/69548

Google Android Browser CVE-2014-6041 Same Origin Policy Security Bypass Vulnerability
http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html

Miscellaneous Ramblings of A Ethical Hacker
Exploit
https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87

1368e05e8875f00e8d2529fe6050d08b55ea4d87 - platform/external/webkit - Git at Google
https://news.ycombinator.com/item?id=8321185

Major Android Bug Is a Privacy Disaster (CVE-2014-6041) | Hacker News
https://news.ycombinator.com/item?id=8325807

Just an update from the Google side: As discussed below, any Android users on 4.... | Hacker News
https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c

7e4405a7a12750ee27325f065b9825c25b40598c - platform/external/webkit - Git at Google

Jump to

Vulnerability Details : CVE-2014-6041