‹ Back to list

CVE-2011-2357

Status: ModifiedMedium (4.3)—Exploit
Severity4.3Medium · CVSS 2.0
Exploitation probability4.61 %higher than 92% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailablePublished on Exploit-DB

Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startActivity function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain.

CVSS

Base score
4.3
Version
2.0
Vector
AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
4.61 %
Percentile among all scored CVEs
92
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (1)

Google — Android

CWEs

References

Show 30 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2011-2357",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-08-12T18:55:04.573",
  "references": [
    {
      "url": "http://android.git.kernel.org/?p=platform/cts.git%3Ba=commit%3Bh=7e48fb87d48d27e65942b53b7918288c8d740e17",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3B%20a=commit%3Bh=096bae248453abe83cbb2e5a2c744bd62cdb620b",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3B%20a=commit%3Bh=afa4ab1e4c1d645e34bd408ce04cadfd2e5dae1e",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://blog.watchfire.com/files/advisory-android-browser.pdf",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://blog.watchfire.com/wfblog/2011/08/android-browser-cross-application-scripting-cve-2011-2357.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://osvdb.org/74260",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Aug/9",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://secunia.com/advisories/45457",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://securityreason.com/securityalert/8335",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://securitytracker.com/id?1025881",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/android_xss.pdf",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/519146/100/0/threaded",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/48954",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68937",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/cts.git%3Ba=commit%3Bh=7e48fb87d48d27e65942b53b7918288c8d740e17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3B%20a=commit%3Bh=096bae248453abe83cbb2e5a2c744bd62cdb620b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3B%20a=commit%3Bh=afa4ab1e4c1d645e34bd408ce04cadfd2e5dae1e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://blog.watchfire.com/files/advisory-android-browser.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://blog.watchfire.com/wfblog/2011/08/android-browser-cross-application-scripting-cve-2011-2357.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/74260",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Aug/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/45457",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/8335",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1025881",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/android_xss.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/519146/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/48954",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68937",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startActivity function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de tipo Cross-application scripting en la funcionalidad de carga de Browser URL en Android versiones 2.3.4 y 3.1, permite que las aplicaciones locales omitan el sandbox y ejecuten JavaScript arbitrario en dominios arbitrarios al (1) causar que un número de pestañas MAX_TAB sean abiertas y luego cargar un URI hacia el dominio de destino en la pestaña actual, o (2) realizar dos llamadas a la función startActivity que comienzan con el URI del dominio de destino seguido del Javascript malicioso mientras que el enfoque de la interfaz de usuario aún está asociado con el dominio de destino."
    }
  ],
  "lastModified": "2026-06-16T23:31:10.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D634E2E3-4E8A-4C88-A6BF-DBE7439EB3B0"
            },
            {
              "criteria": "cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1FD2E59-59BF-4611-B65B-A2981127CAC0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}