Vulnetix
Try Vulnetix Request Demo
ASB-A-175190844 PUBLISHED

In multiple buttons of grant_permissions.xml, there is a possible way to bypass permissions dialogs due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Products

VendorProductVersions
platformframeworks/base11:0, 12, 12:0
platformpackages/modules/Permission12:0, 13-next:0, 13-next
platformframeworks/native12L, 12L:0, 12
platformpackages/apps/PackageInstaller11:0, 11, 11:0

Timeline

References

Open in Interactive Console →