CVE-2020-0074: High severity Google Android vulnerability

Published Sep 8, 2020

Updated

In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-146204120

Affected Software

6 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2020-09-01

Event History

Sep 8, 2020

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 17, 2020

CVE Published

via MITRE·03:21 PM

Data Sourced

via MITRE·03:21 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-0074?

CVE-2020-0074 is considered a moderate severity vulnerability due to the potential for local escalation of privilege.

How do I fix CVE-2020-0074?

The fix for CVE-2020-0074 involves updating affected Android devices to the latest security patch provided by Google.

Which Android versions are affected by CVE-2020-0074?

CVE-2020-0074 affects Android versions 8.0, 8.1, 9.0, 10.0, and 11.0.

What type of vulnerability is CVE-2020-0074?

CVE-2020-0074 is a settings bypass vulnerability that can allow an app to become the default handler for arbitrary domains.

Is user interaction required to exploit CVE-2020-0074?

No, user interaction is not needed for the exploitation of CVE-2020-0074.