Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3803

The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.

Published

2014-05-21T11:14:10.113

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	google	chrome	≤ 35.0.1916.113	Yes
Application	google	chrome	35.0.1916.0	Yes
Application	google	chrome	35.0.1916.1	Yes
Application	google	chrome	35.0.1916.2	Yes
Application	google	chrome	35.0.1916.3	Yes
Application	google	chrome	35.0.1916.4	Yes
Application	google	chrome	35.0.1916.5	Yes
Application	google	chrome	35.0.1916.6	Yes
Application	google	chrome	35.0.1916.7	Yes
Application	google	chrome	35.0.1916.8	Yes
Application	google	chrome	35.0.1916.9	Yes
Application	google	chrome	35.0.1916.10	Yes
Application	google	chrome	35.0.1916.11	Yes
Application	google	chrome	35.0.1916.13	Yes
Application	google	chrome	35.0.1916.14	Yes
Application	google	chrome	35.0.1916.15	Yes
Application	google	chrome	35.0.1916.17	Yes
Application	google	chrome	35.0.1916.18	Yes
Application	google	chrome	35.0.1916.19	Yes
Application	google	chrome	35.0.1916.20	Yes
Application	google	chrome	35.0.1916.21	Yes
Application	google	chrome	35.0.1916.22	Yes
Application	google	chrome	35.0.1916.23	Yes
Application	google	chrome	35.0.1916.27	Yes
Application	google	chrome	35.0.1916.31	Yes
Application	google	chrome	35.0.1916.32	Yes
Application	google	chrome	35.0.1916.33	Yes
Application	google	chrome	35.0.1916.34	Yes
Application	google	chrome	35.0.1916.35	Yes
Application	google	chrome	35.0.1916.36	Yes
Application	google	chrome	35.0.1916.37	Yes
Application	google	chrome	35.0.1916.38	Yes
Application	google	chrome	35.0.1916.39	Yes
Application	google	chrome	35.0.1916.40	Yes
Application	google	chrome	35.0.1916.41	Yes
Application	google	chrome	35.0.1916.42	Yes
Application	google	chrome	35.0.1916.43	Yes
Application	google	chrome	35.0.1916.44	Yes
Application	google	chrome	35.0.1916.45	Yes
Application	google	chrome	35.0.1916.46	Yes
Application	google	chrome	35.0.1916.47	Yes
Application	google	chrome	35.0.1916.48	Yes
Application	google	chrome	35.0.1916.49	Yes
Application	google	chrome	35.0.1916.51	Yes
Application	google	chrome	35.0.1916.52	Yes
Application	google	chrome	35.0.1916.54	Yes
Application	google	chrome	35.0.1916.56	Yes
Application	google	chrome	35.0.1916.57	Yes
Application	google	chrome	35.0.1916.59	Yes
Application	google	chrome	35.0.1916.61	Yes
Application	google	chrome	35.0.1916.68	Yes
Application	google	chrome	35.0.1916.69	Yes
Application	google	chrome	35.0.1916.71	Yes
Application	google	chrome	35.0.1916.72	Yes
Application	google	chrome	35.0.1916.74	Yes
Application	google	chrome	35.0.1916.77	Yes
Application	google	chrome	35.0.1916.80	Yes
Application	google	chrome	35.0.1916.82	Yes
Application	google	chrome	35.0.1916.84	Yes
Application	google	chrome	35.0.1916.85	Yes
Application	google	chrome	35.0.1916.86	Yes
Application	google	chrome	35.0.1916.88	Yes
Application	google	chrome	35.0.1916.90	Yes
Application	google	chrome	35.0.1916.92	Yes
Application	google	chrome	35.0.1916.93	Yes
Application	google	chrome	35.0.1916.95	Yes
Application	google	chrome	35.0.1916.96	Yes
Application	google	chrome	35.0.1916.98	Yes
Application	google	chrome	35.0.1916.99	Yes
Application	google	chrome	35.0.1916.101	Yes
Application	google	chrome	35.0.1916.103	Yes
Application	google	chrome	35.0.1916.104	Yes
Application	google	chrome	35.0.1916.105	Yes
Application	google	chrome	35.0.1916.106	Yes
Application	google	chrome	35.0.1916.107	Yes
Application	google	chrome	35.0.1916.108	Yes
Application	google	chrome	35.0.1916.109	Yes
Application	google	chrome	35.0.1916.110	Yes
Application	google	chrome	35.0.1916.111	Yes
Application	google	chrome	35.0.1916.112	Yes

References

http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/ Exploit ([email protected])
http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html Vendor Advisory ([email protected])
http://secunia.com/advisories/60372 ([email protected])
http://www.securityfocus.com/bid/67582 Third Party Advisory, VDB Entry ([email protected])
https://code.google.com/p/chromium/issues/detail?id=360448 Exploit ([email protected])
https://src.chromium.org/viewvc/blink?revision=171373&view=revision Vendor Advisory ([email protected])
http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/ Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/60372 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/67582 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://code.google.com/p/chromium/issues/detail?id=360448 Exploit (af854a3a-2127-422b-91ae-364da2661108)
https://src.chromium.org/viewvc/blink?revision=171373&view=revision Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)