{"id":"CVE-2012-6636","url":"https://www.cyber-defence.io/tools/cve/CVE-2012-6636","generatedAt":"2026-11-05T07:12:02.193Z","title":"The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded…","description":"The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.","published":"2014-03-03T04:50:46.000Z","lastModified":"2026-06-16T23:48:31.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":6.8,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},"cwe":["CWE-264"],"affected":["google/android api"],"epss":{"score":0.38461,"percentile":0.98576,"date":"2026-11-04","history":[{"date":"2026-09-25","score":0.38461,"percentile":0.98523}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2012-12-21","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":41675,"kind":"exploit","title":"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/41675","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/android/local/41675.rb","file":"exploits/android/local/41675.rb","published":"2012-12-21","added":"2017-03-23","updated":"2017-03-23","author":"Metasploit","type":"local","platform":"android","port":null,"verified":true,"codes":["CVE-2012-6636","CVE-2013-4710","OSVDB-97520"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/rapid7/metasploit-framework/blob/b08d1ad8d8d6c0f5cb63cc44e3ff75efb9edb7b3/modules/exploits/android/browser/webview_addjavascriptinterface.rb"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 38.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://50.56.33.56/blog/?p=314","source":"cve@mitre.org"},{"url":"http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1","source":"cve@mitre.org"},{"url":"http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29","source":"cve@mitre.org"},{"url":"http://jvn.jp/en/jp/JVN62161191/index.html","source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2014/02/07/9","source":"cve@mitre.org"},{"url":"http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://www.internetsociety.org/ndss2014/programme#session3","source":"cve@mitre.org"},{"url":"https://support.lenovo.com/us/en/product_security/len_6421","source":"cve@mitre.org"},{"url":"http://50.56.33.56/blog/?p=314","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://jvn.jp/en/jp/JVN62161191/index.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://openwall.com/lists/oss-security/2014/02/07/9","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.internetsociety.org/ndss2014/programme#session3","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.lenovo.com/us/en/product_security/len_6421","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-6636","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}