Back
CVE-2014-6041
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a…
Medium5.8EPSS 18.3%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
- EPSS (exploitation in 30 days)
- 18.3% · top 2.8% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
n/a
- affected n/a
References (8)
- 69548 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html (opens in a new tab)x_refsource_MISCx_transferred
- https://news.ycombinator.com/item?id=8325807 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://community.rapid7.com/community/metasploit/blog/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041 (opens in a new tab)x_refsource_MISCx_transferred
- https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c (opens in a new tab)x_refsource_CONFIRMx_transferred
- google-android-cve20146041-sec-bypass(95693) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- https://news.ycombinator.com/item?id=8321185 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2014-6041)Record last updated .