PT-2022-14576 · Google · Android

Published 2022-08-01 · Updated 2025-10-20 · CVE-2022-20350

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L

Description The issue is related to improper input validation in the NotificationAccessConfirmationActivity.java file, which can be exploited to trick a victim into granting notification access to the wrong app. This could lead to local information disclosure, with the attack requiring User execution privileges. Notably, user interaction is not necessary for the exploitation to occur.

Recommendations For Android versions Android-10 through Android-12L, update to a version that includes the fix for this issue, as specified in the Android security bulletin.

Fix

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

ASB-A-228178437

CVE-2022-20350

Affected Products

Android

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-20350 · Security Note
• https://source.android.com/security/bulletin/2022-08-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20350 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-228178437 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Car/Settings/+/dcb9c5fb699682ecabce52d569ab8af78e1bb966 · Note
• https://android.googlesource.com/platform/frameworks/base/+/735bcf8cf7a73937eb03ba9474d62ce0498ac64a · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/9d7b4f0fa2100721a5dc00e8fdd1be712b9bbbea · Note
• https://android.googlesource.com/platform/frameworks/base/+/acc83ab08d46755512ceb38d7fc521b2491d6bfb · Note
• https://t.me/cveNotify/139482 · Telegram Post
• https://android.googlesource.com/platform/packages/apps/Settings/+/ff341956043c26cf241fe3529b3d4dbef2e6b2e8 · Note