CVE-2018-12716

The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request.

• CWE-200

• https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/Issue Tracking, Third Party Advisory
• https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
• https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/Third Party Advisory
• https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/Third Party Advisory
• https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/Issue Tracking, Third Party Advisory
• https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
• https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/Third Party Advisory
• https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/Third Party Advisory

Published

Jun 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12710An issue was discovered on D-Link DIR-601 2.02NA devices. Be…
• CVE-2018-12711An XSS issue was discovered in the language switcher module …
• CVE-2018-12712An issue was discovered in Joomla! 2.5.0 through 3.8.8 befor…
• CVE-2018-12713GIMP through 2.10.2 makes g_get_tmp_dir calls to establish t…9.1
• CVE-2018-12714An issue was discovered in the Linux kernel through 4.17.2. …9.8
• CVE-2018-12715DIGISOL DG-HR3400 devices have XSS via a modified SSID when …6.1
• CVE-2018-1272Spring Framework, versions 5.0 prior to 5.0.5 and versions 4…7.5
• CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 …9.8
• CVE-2018-12735SAJ Solar Inverter allows remote attackers to obtain potenti…
• CVE-2018-12739In BEESCMS 4.0, CSRF allows administrators to be added arbit…
• CVE-2018-1274Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5,…7.5
• CVE-2018-1275Spring Framework, versions 5.0 prior to 5.0.5 and versions 4…9.8