CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
76.3%
The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machineβs physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.
Vendor | Product | Version | CPE |
---|---|---|---|
chrome | * | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | |
chrome | 27.0.1453.0 | cpe:2.3:a:google:chrome:27.0.1453.0:*:*:*:*:*:*:* | |
chrome | 27.0.1453.1 | cpe:2.3:a:google:chrome:27.0.1453.1:*:*:*:*:*:*:* | |
chrome | 27.0.1453.2 | cpe:2.3:a:google:chrome:27.0.1453.2:*:*:*:*:*:*:* | |
chrome | 27.0.1453.3 | cpe:2.3:a:google:chrome:27.0.1453.3:*:*:*:*:*:*:* | |
chrome | 27.0.1453.4 | cpe:2.3:a:google:chrome:27.0.1453.4:*:*:*:*:*:*:* | |
chrome | 27.0.1453.5 | cpe:2.3:a:google:chrome:27.0.1453.5:*:*:*:*:*:*:* | |
chrome | 27.0.1453.6 | cpe:2.3:a:google:chrome:27.0.1453.6:*:*:*:*:*:*:* | |
chrome | 27.0.1453.7 | cpe:2.3:a:google:chrome:27.0.1453.7:*:*:*:*:*:*:* | |
chrome | 27.0.1453.8 | cpe:2.3:a:google:chrome:27.0.1453.8:*:*:*:*:*:*:* |
googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html
googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html
habrahabr.ru/post/182706/
code.google.com/p/chromium/issues/detail?id=249335
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16693
src.chromium.org/viewvc/chrome?revision=206188&view=revision