What’s Vulnerable › Vulnerabilities
CVE-2013-2866
- Severity: medium (CVSS 4.3 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2013-06-19 · updated 2026-06-16
- Weakness: CWE-264
Description
The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.
Affected products
- Google Chrome: through 27.0.1453.115; 27.0.1453.0, 27.0.1453.1, 27.0.1453.2, 27.0.1453.3, 27.0.1453.4, 27.0.1453.5 (+80)
- Google ChromeOS: 27.0.1453.115
References
- http://googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html
- http://googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html
- http://habrahabr.ru/post/182706/
- https://code.google.com/p/chromium/issues/detail?id=249335
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16693
- https://src.chromium.org/viewvc/chrome?revision=206188&view=revision
- http://googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html
- http://googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html
- http://habrahabr.ru/post/182706/
- https://code.google.com/p/chromium/issues/detail?id=249335
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16693
- https://src.chromium.org/viewvc/chrome?revision=206188&view=revision
Get alerted when CVE-2013-2866 or the next vulnerability affects your stack