PT-2014-5127 · Google · Google Chrome

Matias Brutti · Published 2014-10-08 · Updated 2014-10-08 · CVE-2014-3187

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 37.0.2062.60 Google Chrome version 38.x prior to 38.0.2125.59 on iOS

Description The issue allows remote attackers to obtain video and audio data from a device via a crafted web site, due to improper restriction of processing of facetime:// and facetime-audio:// URLs.

Recommendations For Google Chrome versions prior to 37.0.2062.60, update to version 37.0.2062.60 or later. For Google Chrome version 38.x prior to 38.0.2125.59 on iOS, update to version 38.0.2125.59 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3187

Affected Products

Google Chrome

References · 5

• 🔥 https://medium.com/section-9-lab/abusing-ios-url-handlers-on-messages-96979e8b12f5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3187 · Security Note
• http://googlechromereleases.blogspot.com/2014/10/chrome-for-ios-update.html · Note
• http://twitter.com/S9Labs/statuses/519576582742999043 · Note
• https://code.google.com/p/chromium/issues/detail?id=413831 · Note