What is CVE-2014-3187?

CVE-2014-3187 is a vulnerability in Apple Iphone OS, classified under Cross-site Scripting. Published 2014-10-08.

Is CVE-2014-3187 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Apple Iphone OS

CVE-2014-3187

Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 on iOS does not properly restrict processing of (1) facetime:// and (2) facetime-audio:// URLs, which allows remote attackers to obtain video and audio data from a device via a crafted web site.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.008 (53.3th percentile) — read the EPSS interpretation.

Affected products

Apple Iphone_os
Google Chrome — versions 37.0.2062.0, 37.0.2062.1, 37.0.2062.2
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

Section9Labs/advisories

References

chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_MISC)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2014-3187?: CVE-2014-3187 is a vulnerability in Apple Iphone OS, classified under Cross-site Scripting. Published 2014-10-08.
Is CVE-2014-3187 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.