CVE-2014-1939

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-03 · updated 2026-06-17
Weakness: CWE-94

Description

java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.

Affected products

Android: through 4.3.1; 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1 (+5)
Lenovo Shareit: through 3.5.88_ww

References

http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html
http://openwall.com/lists/oss-security/2014/02/11/2
https://support.lenovo.com/us/en/product_security/len_6421
http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html
http://openwall.com/lists/oss-security/2014/02/11/2
https://support.lenovo.com/us/en/product_security/len_6421

Get alerted when CVE-2014-1939 or the next vulnerability affects your stack