Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to by…

published 2011-08-12 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-2346

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.6%; EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits: 1; Exploit-DB

Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startActivity function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain.

Timeline

2011-08-02 First public exploit (EDB-36006)
2011-08-12 Published

Exploit prediction

4.61% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-36006 Open Handset Alliance Android 2.3.4/3.1 - Browser Sandbox Security Bypass remote, 2011-08-02

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-20 Improper Input Validation

References

Sources

CVE List CVE-2011-2357
NVD CVE-2011-2357

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary