CVE-2014-9689
published 2015-03-09CVE-2014-9689: content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope…
PriorityP421medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.26%
66.7th percentile
content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope data, which makes it easier for remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for ondeviceorientation events, a different vulnerability than CVE-2015-1231.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 40.0.2214.115 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7rwv-vwp5-wfxw: content/renderer/device_sensors/device_orientation_event_pump
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2014-9689 [HIGH] GHSA-7rwv-vwp5-wfxw: content/renderer/device_sensors/device_orientation_event_pump
content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope data, which makes it easier for remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for ondeviceorientation events, a different vulnerability than CVE-2015-1231.
OSV
CVE-2014-9689: content/renderer/device_sensors/device_orientation_event_pump
osv·2015-03-09·CVSS 5.0
CVE-2014-9689 [MEDIUM] CVE-2014-9689: content/renderer/device_sensors/device_orientation_event_pump
content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope data, which makes it easier for remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for ondeviceorientation events, a different vulnerability than CVE-2015-1231.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.htmlhttps://code.google.com/p/chromium/issues/detail?id=421691https://code.google.com/p/chromium/issues/detail?id=463349https://crypto.stanford.edu/gyrophone/files/gyromic.pdfhttps://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/michalevskyhttp://googlechromereleases.blogspot.com/2015/03/stable-channel-update.htmlhttps://code.google.com/p/chromium/issues/detail?id=421691https://code.google.com/p/chromium/issues/detail?id=463349https://crypto.stanford.edu/gyrophone/files/gyromic.pdfhttps://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/michalevsky
2015-03-09
Published