Skip to content

CVE-2012-4908

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin...

7.5 HighPublic exploit

CVE-2012-4908 is a high vulnerability (CVSS 7.5) in Google Chrome, published September 13, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. No source names a fixed version.

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink.

Exploit likelihood

3.35%Down 3.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink.

Record: CVE-2012-4908
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink.

Record: CVE-2012-4908
Updated: 2026-11-02

EUVDEUVD-2012-4833 No score

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink.

Record: EUVD-2012-4833
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g64x-vj36-x7px No score

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin...

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink.

Record: GHSA-g64x-vj36-x7px
Updated: 2026-11-02

Affected products

google chrome

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Google Chrome for Android - Same-origin Policy Bypass Local Symlink	2012-09-12

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

References