CVE-2021-39663

In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39663

CVE-2021-39663 affects Android 10 and is linked to MediaProvider.java’s openFileAndEnforcePathPermissionsHelper. The vulnerability describes a bypass of a permissions check caused by a confused deputy, enabling local elevation of privilege without user interaction. The Android CVE entry documents...