Platform Packages Apps Contacts vulnerabilities

CVE-2025-48523 CVE-2025-48523: In onCreate of SelectAccountActivity In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20134 CVE-2022-20134: In readArguments of CallSubjectDialog In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0952 CVE-2021-0952: In doCropPhoto of PhotoSelectionHandler In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure of user's contacts with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2021-0926 CVE-2021-0926: In onCreate of NfcImportVCardActivity In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0603 CVE-2021-0603: In onCreate of ContactSelectionActivity In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.

CVE-2021-0444 CVE-2021-0444: In onActivityResult of QuickContactActivity In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. This could lead to local information disclosure of contact data with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2021-0446 CVE-2021-0446: In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.

CVE-2020-0422 CVE-2020-0422: In constructImportFailureNotification of NotificationImportExportListener In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.