CVE-2020-0080: Critical severity Google Android vulnerability

Published Apr 6, 2020

Updated

In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification icon that it's overlaying. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-144092031

Affected Software

2 affected components

Google Android=10.0

Google Android

Event History

Apr 6, 2020

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Apr 17, 2020

CVE Published

via MITRE·06:19 PM

Data Sourced

via MITRE·06:19 PM

DescriptionWeakness

Frequently Asked Questions

Which Android releases are identified as affected?

The affected version listed is Android 10.

What must an attacker be able to do to exploit this issue?

Exploitation requires local access and user interaction. The attacker needs execution with User privileges.

What is the practical impact of successful exploitation?

An app may be able to display an overlay over other apps without showing the notification icon indicating that it is overlaying. The issue can lead to local escalation of privilege with high confidentiality, integrity, and availability impact.