PT-2021-13244 · Google · Android

Published 2021-07-01 · Updated 2021-07-16 · CVE-2021-0603

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions Android-11

Description: The issue is related to a tapjacking/overlay attack in the onCreate method of ContactSelectionActivity.java, allowing access to contacts without permission. This could lead to local escalation of privilege, requiring User execution privileges and user interaction for exploitation.

Recommendations: For Android version Android-11, consider restricting access to the ContactSelectionActivity until a patch is available, or apply configuration changes to minimize the risk of exploitation, such as disabling overlay attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ASB-A-182809425

CVE-2021-0603

Affected Products

Android

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-0603 · Security Note
• https://osv.dev/vulnerability/ASB-A-182809425 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0603 · Vendor Advisory
• https://t.me/cvenotify/17749 · Telegram Post
• https://android.googlesource.com/platform/packages/apps/Contacts/+/19ff4ed838d4ec83cd10eeac80878205f8817e69 · Note