CVE-2014-1939
Android < 4.3.1 - Remote Code Execution via SearchBoxImpl JavaScript Interface
Title source: llmDescription
java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
References (3)
Core 3
Core References
Various Sources x_refsource_confirm
http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2014/02/11/2
Various Sources x_refsource_confirm
https://support.lenovo.com/us/en/product_security/len_6421
Scores
EPSS
0.0026
EPSS Percentile
49.0%
Details
CWE
CWE-94
Status
published
Products (13)
google/android
4.0
google/android
4.0.1
google/android
4.0.2
google/android
4.0.3
google/android
4.0.4
google/android
4.1
google/android
4.1.2
google/android
4.2
google/android
4.2.1
google/android
4.2.2
... and 3 more
Published
Mar 03, 2014
Tracked Since
Feb 18, 2026