PT-2025-36014

Name of the Vulnerable Software and Affected Versions: ContentProtectionTogglePreferenceController.java affected versions not specified Description: A logic error in the updateState function within ContentProtectionTogglePreferenceController.java may allow a secondary user to disable the deceptiv...

PT-2025-36044

Name of the Vulnerable Software and Affected Versions: ContentProtectionTogglePreferenceController.java affected versions not specified Description: A logic error in the updateState function within ContentProtectionTogglePreferenceController.java may allow a secondary user to disable the deceptiv...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a logic error in the updateState function in ContentProtectionTogglePreferenceController.java, which can be exploited by an attacker to elevate...

CVE-2025-22428

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22428

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22428

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-22428

The CVE describes a logic error in AppInfoBase.java hasInteractAcrossUsersFullPermission that could allow granting permissions to a secondary user from the primary user, enabling local privilege escalation without user interaction. Affected component: Android framework/AppInfoBase.java. Impact: l...

CVE-2023-21311

In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-341886134

In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-7205

CVE-2024-7205 affects eWeLink Cloud Service, specifically the homepage module prior to version 2.19.0. When a device is shared, a secondary user can take over control as the primary user by disclosed unnecessary device-sensitive information. The CVSS data in the initial document indicates high im...

CVE-2024-7205 sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user

When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information...

eWeLink 安全漏洞

eWeLink is a smart home assistant from eWeLink, Inc. A security vulnerability exists in eWeLink versions prior to 2.19.0, which stems from a vulnerability that allows a secondary user to take over a device to become the primary user by sharing unnecessary sensitive information about the device wh...

PT-2024-38166

Name of the Vulnerable Software and Affected Versions: eWeLink Cloud Service versions prior to 2.19.0 eWeLink Cloud Service versions up to 2.18.x Description: When a device is shared, the homepage module in eWeLink Cloud Service allows a secondary user to take over devices as a primary user by...

How to remove a user from a shared Android device

Some of our loyal readers may remember my little mishap when I was able to track my wife by accident after inadvertently adding myself to her phone as a user. For exactly that reason we want to warn against sharing devices and at least show you how to remove other people’s accounts from your...

CVE-2023-21311

In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18088 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue allows a secondary user to control private DNS settings due to a permissions bypass in the Settings application. This could lead to local information disclosure without...

ASB-A-238298970

In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC from a secondary account due to a permissions bypass. This could lead to local escalation of privilege from the Guest account with no additional execution privileges needed. User...