Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-8320: Apache Cordova Android may allow bridge hijacking

CVE-2015-8320 · published 10 years ago

Summary

Older versions of Apache Cordova for Android create weak random numbers used to protect the communication bridge, making it possible for an attacker to guess the secret value. If the secret is guessed, the attacker can take control of the bridge between the app and the native code. Upgrade to Cordova 3.7.0 or later, or apply the vendor's recommended fix, to use stronger random values.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
apache	cordova	<= 3.6.4 `cpe:2.3:a:apache:cordova::::::android::*`

Original advisory text

Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

4% chance of attack within 30 days

Timeline

Published23 Nov 2015

Updated24 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-8320 · NVD

Track software like this

Free during beta