CVE-2012-6636
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods...
- Published
- Mar 3, 2014
- Updated
- Aug 6, 2024
- Assigning CNA
- mitre
- Evidence observed
- Dec 21, 2012
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:PModerate · next 30 days
- Percentile
- 98.5%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
Sources
modules/exploits/android/browser/webview_addjavascriptinterface.rb
Metasploit Framework modulesDeclared conditions
- platform: Android,Linux($.exploit_android/browser/webview_addjavascriptinterface.platform)
- verification: check_not_declared($.exploit_android/browser/webview_addjavascriptinterface.check)
An app demo for test android webview security issue: CVE-2012-6636
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.