Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

CVE-2019-15414

The Asus ZenFone AR Android device with a build fingerprint of asus/WWASUSA002/ASUSA002:7.0/NRD90M/14.1600.1805.51-20180626:user/release-keys contains a pre-installed app with a package name of com.asus.splendidcommandagent app versionCode=1510200105, versionName=1.2.0.21180605 that allows other...

CVE-2019-15463

Affected software: Samsung j7popeltemtr Android device (build samsung/j7popeltemtr/j7popeltemtr:8.1.0/M1AJQ/J727T1UVS5BSC2:user/release-keys).Vulnerable component: pre-installed app com.samsung.android.themecenter (versionCode 7000100, versionName 7.0.1.0).Root cause: an accessible component expo...

CVE-2019-15459

The CVE-2019-15459 entry concerns the Samsung J7 Neo (build samsung/j7velteub/j7velte:8.1.0) where a pre-installed app (com.samsung.android.themecenter, v7.0.1.0) can be leveraged by other pre-installed apps to install apps via an exported component. Root cause is that these pre-installed apps ex...

CVE-2019-15414

The Asus ZenFone AR Android device with a build fingerprint of asus/WWASUSA002/ASUSA002:7.0/NRD90M/14.1600.1805.51-20180626:user/release-keys contains a pre-installed app with a package name of com.asus.splendidcommandagent app versionCode=1510200105, versionName=1.2.0.21180605 that allows other...

CVE-2019-15405

The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000015, versionName=7.0.0.3161222 that allows other...

CVE-2019-15389

The Haier A6 Android device with a build fingerprint of Haier/A6/A6:8.1.0/O11019/1534219877:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service named...

Google Warns of Growing Android Attack Vector: Backdoored SDKs and Pre-Installed Apps

Google is reporting an uptick in efforts by bad actors to plant potentially harmful applications PHAs on Android devices via pre-installed apps and by bundling them with system updates delivered over the air. The technique is especially troubling, Google said, because PHAs are often malicious and...

Flaws in Pre-Installed Apps Expose Millions of Android Devices to Hackers

Bought a new Android phone? What if I say your brand new smartphone can be hacked remotely? Nearly all Android phones come with useless applications pre-installed by manufacturers or carriers, usually called bloatware, and there's nothing you can do if any of them has a backdoor built-in—even if...

Security Advisory - Authentication Bypass Vulnerability in Some Pre-installed Apps on Huawei Phones

There is an authentication bypass vulnerability in some pre-installed apps on Huawei mobile phones due to insufficient validation on invocation requests. An attacker may trick a user into installing a malicious app which can invoke the open interfaces of the vulnerable apps to install any apps...

Android Framework APIs Component Privilege Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA.Framework APIs are one of the API components used to create the framework. A power lifting vulnerability exists in the Framework APIs component in Android. An attacker can exploit...

New Android Smartphones will Come with Fewer Pre-installed Apps

A sigh of relief indeed! Google is finally listening to us; it is ditching its haunting bloatware from the upcoming Android smartphones and tablets. As per the current situation, our Android devices are attacked with Google's suite of apps like Google Play Games, Google Newsstand, Google Play...

Xiaomi Mi 4 Smartphone Pre-loaded with Malware and Custom Android ROM

Once again the very popular and the world's third largest smartphone distributor Xiaomi, which had previously been criticized for secretly stealing users’ information from the device without the user's permissions, has been found spreading malware. The top selling Android smartphone in China,...