CVE-2021-0302 — UI Misrepresentation / Clickjacking in Packages Apps Packageinstaller

CWE-1021 — UI Misrepresentation / Clickjacking5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 80.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Packages Apps PackageinstallerGoogle Android
Timeline
PublishedFeb 10
Latest updateMay 24

Description

In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-155287782

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5google/androidAndroid-8.1 Android-9 Android-10
▶NVDgoogle/android10.0, 8.1, 9.0+2
▶Androidplatform/packages_apps_packageinstaller8.0:0 — 8.0:2021-02-01+4

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-hgpj-7pfx-q3m9: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2022-05-24
▶
CVEList
CVE-2021-0302: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2021-02-10
▶
OSV
CVE-2021-0302: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2021-02-01
▶

📋Vendor Advisories

1
Android
CVE-2021-0302: Android Security Bulletin 2021-02-01 CVE: CVE-2021-0302 Severity: HIGH Type: EoP Affected AOSP versions: 8↗2021-02-01
▶
CVE-2021-0302 — UI Misrepresentation / Clickjacking | cvebase