4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
5.5 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
76.3%
The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machineβs physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.
googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html
googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html
habrahabr.ru/post/182706/
code.google.com/p/chromium/issues/detail?id=249335
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16693
src.chromium.org/viewvc/chrome?revision=206188&view=revision