CVE-2022-20448: Incorrect Default Permissions

In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20448

The CVE-2022-20448 issue affects Android (10–13) via the buzzBeepBlinkLocked path in NotificationManagerService.java, enabling data sharing across users due to a permissions bypass and resulting in local privilege escalation without extra execution privileges. The exposed component is Android’s N...