CVE-2022-20442

CVE-2022-20442 is a local elevation-of-privilege in Android via ReviewPermissionsActivity.java: an overlay/tapjacking path could allow granting permissions to another app on devices with API

CVE-2022-20501

CVE-2022-20501 affects Android by described tapjacking/overlay in EnableAccountPreferenceActivity.onCreate, enabling a malicious phone account and potential local elevation of privilege. Affected: Android 10–13 (Android-10, -11, -12, -12L, -13). No exploit details provided in the supplied documen...

CVE-2022-20442

In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...

ASB-A-176094367

In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

PUB-A-227203202

In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation...

Privilege escalation

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-20331

CVE-2022-20331 affects the Android 13 Framework. A tapjacking/overlay flaw can enable a work profile without user consent, causing local escalation of privilege. Exploitation requires user interaction but does not need extra execution privileges. CVSS v3.1 base score is High (7.8) with LOCAL atta...

PT-2022-14557 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue allows for a possible tapjacking/overlay attack, enabling a work profile without user consent. This could lead to local escalation of privilege with no additional execution...

CVE-2022-33723

A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33723

A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

Code injection

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

CVE-2022-33727 describes a vulnerability in the SecDevicePickerDialog onCreate prior to Samsung SMR Aug-2022 Release 1, where flawed UI handling enables a tapjacking/overlay attack to trick users into selecting an unwanted Bluetooth device. The issue is documented across multiple sources (NVD, Re...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33723

CVE-2022-33723 concerns a vulnerable code path in the BluetoothScanDialog component on Android/Samsung devices. The issue is located in the onCreate method of BluetoothScanDialog, where an attacker could trick a user into selecting an unwanted Bluetooth device via a tapjacking/overlay attack. Aff...

PT-2022-21844 · Unknown · Secdevicepickerdialog

Name of the Vulnerable Software and Affected Versions: SecDevicePickerDialog versions prior to SMR Aug-2022 Release 1 Description: A vulnerable code in the onCreate method of SecDevicePickerDialog allows attackers to trick the user into selecting an unwanted Bluetooth device via tapjacking or...

CVE-2022-20212

In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

Design/Logic Flaw

In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2022-20007

In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges neede...

Google Android elevation of privilege vulnerability (CNVD-2022-41834)

Google Android is a Linux-based open source operating system from Google. Google Android 11 suffers from an elevation of privilege vulnerability that originates in onCreate in UsbPermissionActivity.java, which can be exploited by an attacker to cause local privilege escalation...