Vulnerability Description
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android Api | <= 16.0 |
Related Weaknesses (CWE)
References
- http://50.56.33.56/blog/?p=314
- http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY
- http://developer.android.com/reference/android/webkit/WebView.html#addJavascript
- http://jvn.jp/en/jp/JVN62161191/index.html
- http://openwall.com/lists/oss-security/2014/02/07/9
- http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdfExploit
- http://www.internetsociety.org/ndss2014/programme#session3
- https://support.lenovo.com/us/en/product_security/len_6421
- http://50.56.33.56/blog/?p=314
- http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY
- http://developer.android.com/reference/android/webkit/WebView.html#addJavascript
- http://jvn.jp/en/jp/JVN62161191/index.html
- http://openwall.com/lists/oss-security/2014/02/07/9
- http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdfExploit
- http://www.internetsociety.org/ndss2014/programme#session3
FAQ
What is CVE-2012-6636?
CVE-2012-6636 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection ...
How severe is CVE-2012-6636?
CVE-2012-6636 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-6636?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android Api.