VulnerabilityModified
CVE-2014-3803
The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.
MEDIUM 4.3EPSS 1.37%
Does this matter?
Lower severity and a low EPSS score (1.37%). Track it; it rarely justifies an emergency change on its own.
Description
The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.37% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- google/chrome
- Source
- cve@mitre.org
References
- http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/Exploit
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.htmlVendor Advisory
- http://secunia.com/advisories/60372
- http://www.securityfocus.com/bid/67582Third Party Advisory, VDB Entry
- https://code.google.com/p/chromium/issues/detail?id=360448Exploit
- https://src.chromium.org/viewvc/blink?revision=171373&view=revisionVendor Advisory
- http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/Exploit
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.htmlVendor Advisory
- http://secunia.com/advisories/60372
- http://www.securityfocus.com/bid/67582Third Party Advisory, VDB Entry
- https://code.google.com/p/chromium/issues/detail?id=360448Exploit
- https://src.chromium.org/viewvc/blink?revision=171373&view=revisionVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.