CVE-2017-13274

CRITICAL

Google Android - Origin Validation Error

Title source: rule

Description

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71360761.

References (1)

[Vendor Advisory] https://source.android.com/security/bulletin/2018-04-01

Scores

CVSS v3 9.8

EPSS 0.0008

EPSS Percentile 22.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-346

Status published

Affected Products (7)

google/android

Timeline

Published Apr 04, 2018

Tracked Since Feb 18, 2026