CVE-2019-2218: High severity Google Android vulnerability
In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to local escalation of privilege by installing malicious packages with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-141169173
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Devices running Android 8.0, 8.1, 9, or 10 are listed as affected. Exploitation is local and requires an attacker to have User-level execution privileges on the device.
Does exploitation require user interaction?
No. The issue can be exploited without user interaction once the attacker has the required local User execution privileges.
What is the potential impact?
An attacker may improperly obtain permissions by installing malicious packages, leading to local escalation of privilege. The supplied CVSS vector indicates high impact to confidentiality, integrity, and availability.