CVE-2021-0305 — UI Misrepresentation / Clickjacking in Packages Apps Packageinstaller

CWE-1021 — UI Misrepresentation / Clickjacking5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Platform Packages Apps PackageinstallerPlatform Packages Apps SettingsGoogle Android
Timeline
PublishedFeb 10
Latest updateMay 24

Description

In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-154015447

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/androidAndroid-8.1 Android-9 Android-10
▶NVDgoogle/android10.0, 8.1, 9.0+2
▶Androidplatform/packages_apps_packageinstaller8.0:0 — 8.0:2021-02-01+4
▶Androidplatform/packages_apps_settings8.0:0 — 8.0:2021-02-01+4

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qp58-fc8h-jpwx: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2022-05-24
▶
CVEList
CVE-2021-0305: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2021-02-10
▶
OSV
CVE-2021-0305: In PackageInstaller, there is a possible tapjacking attack due to an insecure default value↗2021-02-01
▶

📋Vendor Advisories

1
Android
CVE-2021-0305: Android Security Bulletin 2021-02-01 CVE: CVE-2021-0305 Severity: HIGH Type: EoP Affected AOSP versions: 8↗2021-02-01
▶
CVE-2021-0305 — UI Misrepresentation / Clickjacking | cvebase