CVE-2020-0031: Infoleak
In triggerAugmentedAutofillLocked and related functions of Session.java, it is possible for Augmented Autofill to display sensitive information to the user inappropriately. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141703197
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected product and version identified are Google Android 10. Exploitation is local, so it applies to users who can interact directly with an affected device.
What does an attacker need to exploit it?
The attacker needs local access, low privileges, and user interaction. No additional execution privileges are required.
What is the impact if exploitation succeeds?
Augmented Autofill can display sensitive information to the user inappropriately, resulting in local information disclosure. The supplied CVSS vector indicates high confidentiality impact with no integrity or availability impact.