CVE-2021-39697: Missing Authorization

In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private directories protection due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...

PT-2022-10980

Name of the Vulnerable Software and Affected Versions Android versions Android-11 through Android-12 Description The issue is related to a missing permission check in the checkFileUriDestination function of DownloadProvider.java. This could allow bypassing external storage private directories...