CVE-2014-3803

The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.

• CWE-200

• http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/Exploit
• http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.htmlVendor Advisory
• http://secunia.com/advisories/60372
• http://www.securityfocus.com/bid/67582Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=360448Exploit
• https://src.chromium.org/viewvc/blink?revision=171373&view=revisionVendor Advisory
• http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/Exploit
• http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.htmlVendor Advisory
• http://secunia.com/advisories/60372
• http://www.securityfocus.com/bid/67582Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=360448Exploit
• https://src.chromium.org/viewvc/blink?revision=171373&view=revisionVendor Advisory

Published

May 21, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3797Cross-site scripting (XSS) vulnerability in VMware vCenter S…
• CVE-2014-3798The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earl…
• CVE-2014-3799Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3800XBMC 13.0 uses world-readable permissions for .xbmc/userdata…
• CVE-2014-3801OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 a…
• CVE-2014-3802msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as …
• CVE-2014-3804The av-centerd SOAP service in AlienVault OSSIM before 4.7.0…
• CVE-2014-3805The av-centerd SOAP service in AlienVault OSSIM before 4.7.0…
• CVE-2014-3806Directory traversal vulnerability in cgi-bin/help/doIt.cgi i…
• CVE-2014-3807Multiple cross-site scripting (XSS) vulnerabilities in Barra…
• CVE-2014-3808Multiple cross-site scripting (XSS) vulnerabilities in Barra…
• CVE-2014-3809Cross-site scripting (XSS) vulnerability in the management i…6.1