CVE-2024-31974

6.3 mediumEPSS 0.6%

Medium (6.3). EPSS 0.6% chance of exploitation in the next 30 days.

The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately sanitize the URI or any extra data passed in the intent by any installed application (with no permissions).

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2024-05-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/actuator/com.solarized.firedown/blob/main/CVE-2024-31974
https://github.com/actuator/com.solarized.firedown/blob/main/CVE-2024-31974

Check your stack JSON