CVE-2013-4710

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 43.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-03-03 · updated 2026-06-16
Weakness: CWE-20

Description

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

Affected products

Android: 3.0, 3.1, 3.2, 3.2.1, 3.2.2, 3.2.4 (+8)

References

http://50.56.33.56/blog/?p=314
http://emobile.jp/products/sh/a01sh/systemsoftware.html
http://jvn.jp/en/jp/JVN53768697/113349/index.html
http://jvn.jp/en/jp/JVN53768697/397327/index.html
http://jvn.jp/en/jp/JVN53768697/995293/index.html
http://jvn.jp/en/jp/JVN53768697/995312/index.html
http://jvn.jp/en/jp/JVN53768697/995417/index.html
http://jvn.jp/en/jp/JVN53768697/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000111
http://openwall.com/lists/oss-security/2014/02/18/11
http://50.56.33.56/blog/?p=314
http://emobile.jp/products/sh/a01sh/systemsoftware.html

Get alerted when CVE-2013-4710 or the next vulnerability affects your stack