Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-6041.
PoCs published by Rafay Baloch, joev, including Metasploit module auxiliary/admin/android/google_play_store_uxss_xframe_rce.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-6041, a UXSS vulnerability in Android's AOSP Browser, combined with a lack of X-Frame-Options enforcement in Google Play Store error pages to achieve remote code execution by installing and launching arbitrary apps.
Description
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.
Exploits (3)
This Metasploit module exploits CVE-2014-6041, a UXSS vulnerability in Android's AOSP Browser, combined with a lack of X-Frame-Options enforcement in Google Play Store error pages to achieve remote code execution by installing and launching arbitrary apps.
This Metasploit module exploits a Universal Cross-Site Scripting (UXSS) vulnerability in Android's stock browser (CVE-2014-6041) to steal cookies and page contents. It uses iframe injection or a popup-based bypass for X-Frame-Options, executing arbitrary JavaScript in the context of targeted URLs.
This Metasploit module exploits a Universal Cross-Site Scripting (UXSS) vulnerability in Android's stock browser and WebView components before version 4.4. It leverages the vulnerability to steal cookie data and page contents from targeted URLs by injecting malicious JavaScript.