CVE-2024-31324 — UI Misrepresentation / Clickjacking in Frameworks Base

CWE-1021 — UI Misrepresentation / Clickjacking4 documents4 sources
Severity
7.3HIGHNVD
EPSS
0.0%
top 99.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedJul 9

Description

In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode first and then rotating it to landscape mode. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.3 | Impact: 5.9

Affected Packages4 packages

▶Androidplatform/frameworks_base14-next:0 — 14-next:2024-06-01+4
▶CVEListV5google/android4 versions+3
▶NVDgoogle/android4 versions+3

Patches

Patch: android.googlesource.com ↗Patch: source.android.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8v98-3h75-pjr6: In hide of WindowState↗2024-07-09
▶
OSV
CVE-2024-31324: In hide of WindowState↗2024-06-01
▶

📋Vendor Advisories

1
Android
CVE-2024-31324: Android Security Bulletin 2024-06-01 CVE: CVE-2024-31324 Severity: HIGH Type: EoP Affected AOSP versions: 12, 12L, 13, 14 References: A-302431573↗2024-06-01
▶