CVE-2021-0304

2021-01-1121:47:14

google_android

www.cve.org

globalscreenshot.java

permission bypass

local information disclosure

android

user execution privileges

AI Score

5.4

Confidence

High

EPSS

Percentile

5.1%

JSON

In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user’s contacts with User execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-8.0, Android-8.1, Android-9; Android ID: A-162738636.

CNA Affected

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android-10"
      },
      {
        "status": "affected",
        "version": "Android-8.0"
      },
      {
        "status": "affected",
        "version": "Android-8.1"
      },
      {
        "status": "affected",
        "version": "Android-9"
      }
    ]
  }
]

References

source.android.com/security/bulletin/2021-01-01