PendingIntent hijack vulnerability in SipAccountRegistry.java

2022-03-0100:00:00

Google

osv.dev

vulnerability

sipaccountregistry

permission bypass

pendingintent

local escalation

privilege

user execution

exploitation

software

AI Score

7.1

Confidence

High

EPSS

Percentile

5.1%

JSON

In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.