CVE-2023-3612CWE-749

Unprotected WebView access in Govee Home App

High · published September 11, 2023

CVSS v3.1
8.2
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00513 · 42.9th percentile
Weakness
CWE-749 · Exposed Dangerous Method or Function
Published
2023-09-11T09:04Z
EPSS history
Timeline
  • 11 SEP 09:04Z
    Unprotected WebView access in Govee Home App
    cvelistv5