Lucene search

ChromeCVE-2014-3201

HistoryOct 10, 2014 - 1:55 a.m.

CVE-2014-3201

2014-10-1001:55:08

CWE-119

Chrome

web.nvd.nist.gov

cve-2014-3201

vulnerability

blink

google chrome

android

nvd

remote attackers

spoofing

web security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

58.8%

JSON

core/rendering/compositing/RenderLayerCompositor.cpp in Blink, as used in Google Chrome before 38.0.2125.102 on Android, does not properly handle a certain IFRAME overflow condition, which allows remote attackers to spoof content via a crafted web site that interferes with the scrollbar.

Affected configurations

Nvd

Node

googlechromeRange≤38.0.2125.101android

VendorProductVersionCPE
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
google	chrome	*	cpe:2.3:a:google:chrome::::::android::*

References

googlechromereleases.blogspot.com/2014/10/chrome-for-android-update.html

crbug.com/406593

src.chromium.org/viewvc/blink?revision=182021&view=revision

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

58.8%

JSON

Related for CVE-2014-3201