Vulnerability in Google Android

CVE-2014-3161

The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video stream.

EPSS: 0.009 (55.3th percentile) — read the EPSS interpretation.

Affected products

Google Android
Google Chrome — versions 36.0.1985.1, 36.0.1985.2, 36.0.1985.3
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)