CVE-2018-9524 — UI Misrepresentation / Clickjacking in INC Android

CWE-1021 — UI Misrepresentation / Clickjacking4 documents4 sources

Severity

7.8HIGHNVD

EPSS

0.0%

top 95.21%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google INC Android Google Android

Timeline

PublishedNov 14

Latest updateMay 13

Description

In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDgoogle/android5 versions+4

▶CVEListV5google_inc/androidAndroid-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

GHSA

GHSA-rhpq-gc3g-23vr: In functionality implemented in System UI, there are insufficient protections implemented around overlay windows↗2022-05-13

▶

CVEList

CVE-2018-9524: In functionality implemented in System UI, there are insufficient protections implemented around overlay windows↗2018-11-14

▶

📋Vendor Advisories

Android

CVE-2018-9524: Android Security Bulletin 2018-11-01 CVE: CVE-2018-9524 Severity: HIGH Type: EoP Affected AOSP versions: 7↗2018-11-01

▶