$ cve CVE-2010-1807 JSON

CVE-2010-1807 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 61.3% (pctl 99)

Patch early

A public exploit exists.

Description

WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to non-standard NaN representation.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	61.32% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2010-09-10
Last modified	2026-06-16

Affected (3)

Vendor	Product
apple	safari
google	android
webkitgtk	webkitgtk

Public exploits

Source	Title	Date
exploit-db	Google Android 2.0/2.1 - Use-After-Free Remote Code Execution on Webkit	2010-11-15
exploit-db	Google Android 2.0 < 2.1 - Code Execution (Reverse Shell 10.0.2.2:2222/TCP)	2010-11-05

References

→ the Explorer · watch your stack · NVD