{"id":"CVE-2013-2866","aliases":["EUVD-2013-2805","GHSA-qj7f-jf6q-v5f2"],"status":"published","title":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0...","description":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01403,"percentile":0.72726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-06-19T20:00:00Z","modified":"2026-06-16T23:54:06Z","products":[{"vendor":"google","product":"chrome"},{"vendor":"google","product":"chrome_os"}],"references":[{"url":"http://googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://habrahabr.ru/post/182706/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://code.google.com/p/chromium/issues/detail?id=249335","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://src.chromium.org/viewvc/chrome?revision=206188\u0026view=revision","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16693","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2866"},{"url":"http://habrahabr.ru/post/182706"},{"url":"https://github.com/advisories/GHSA-qj7f-jf6q-v5f2"}],"sources":{"cve":[{"id":"CVE-2013-2866","description":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.","status":"published","published":"2013-06-19T20:00:00Z","modified":"2024-08-06T15:52:21.195Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-2805","description":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.","status":"published","published":"2013-06-19T20:00:00Z","modified":"2024-08-06T15:52:21Z","updated_at":"2026-11-03T01:56:37.16587Z"}],"ghsa":[{"id":"GHSA-qj7f-jf6q-v5f2","title":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0...","description":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.","status":"published","published":"2022-05-17T00:54:49Z","modified":"2025-04-11T04:12:24Z","updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-2866","description":"The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.","status":"published","published":"2013-06-19T20:55:01.303Z","modified":"2026-06-16T23:54:06.35Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}]}}