PT-2022-1358 · Google+1 · Android+1

Published 2022-04-01 · Updated 2022-04-20 · CVE-2021-39796

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L

Description The issue allows an attacker to trick a victim into installing a harmful app through a tapjacking/overlay attack in the HarmfulAppWarningActivity. This could lead to local escalation of privilege, requiring User execution privileges and user interaction for exploitation.

Recommendations For Android versions Android-10 through Android-12L, consider restricting access to the HarmfulAppWarningActivity until a patch is available. As a temporary workaround, avoid interacting with suspicious app warnings to minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ASB-A-205595291

CVE-2021-39796

Affected Products

Android

Debian

References · 10

• https://ubuntu.com/security/CVE-2021-39796 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39796 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-04-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39796 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39796 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-39796 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-205595291 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39796 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39796 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/e74a2a320bf896bc30618ce486203bafe453c469 · Note