CVE-2017-13274

CRITICAL

Android 6.0-8.1 - Origin Validation Error in UriTest.java getHost()

Title source: llm

Description

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71360761.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2018-04-01

Scores

CVSS v3 9.8

EPSS 0.0054

EPSS Percentile 41.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-346

Status published

Products (7)

google/android 6.0

google/android 6.0.1

google/android 7.0

google/android 7.1.1

google/android 7.1.2

google/android 8.0

google/android 8.1

Published Apr 04, 2018

Tracked Since Feb 18, 2026