CVE-2011-2357

CVE-2011-2357 describes a cross-application scripting vulnerability in the Browser URL loading functionality of Android versions 2.3.4 and 3.1. This flaw allows local applications to bypass the browser's sandbox, enabling the execution of arbitrary Javascript within arbitrary domains. An attacker could achieve this by either forcing the browser to open a maximum number of tabs and then loading a malicious URI, or by using specific startActivity calls to inject Javascript while the UI is focused on the target domain. The vulnerability has a CVSS score of 4.3, indicating a medium severity. It requires medium attack complexity (AC:M) and user interaction, but does not require authentication (Au:N). The potential impact is primarily integrity (I:P), allowing for unauthorized modification of data through script execution. While not listed on the CISA KEV catalog, an exploit for this vulnerability (EDB-36006) is available on ExploitDB. There is no evidence of active exploitation, and the CVE has received minimal community discussion or media coverage.