What is CVE-2014-3159?

CVE-2014-3159 is a vulnerability in Google Android, classified under Improper Input Validation. Published 2014-07-20.

Is CVE-2014-3159 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Google Android

CVE-2014-3159

The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the Omnibox via unspecified vectors.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.

Affected products

Google Android
Google Chrome — versions 36.0.1985.1, 36.0.1985.2, 36.0.1985.3
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2014-3159?: CVE-2014-3159 is a vulnerability in Google Android, classified under Improper Input Validation. Published 2014-07-20.
Is CVE-2014-3159 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.