CVE-2020-0099: High severity Google Android vulnerability
In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. This could lead to local escalation of privilege via tapjacking with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 8.0:2020-12-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 8.1:2020-12-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 9:2020-12-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 10:2020-12-01
Event History
Frequently Asked Questions
What is CVE-2020-0099?
CVE-2020-0099 is a vulnerability in the Android operating system that allows for a window overlay attack, potentially leading to local privilege escalation.
What is the severity of CVE-2020-0099?
CVE-2020-0099 has a severity rating of 7.8 (High).
Which versions of Android are affected by CVE-2020-0099?
Versions 8.0, 8.1, 9.0, and 10.0 of Google Android are affected by CVE-2020-0099.
How can an attacker exploit CVE-2020-0099?
An attacker can exploit CVE-2020-0099 by utilizing a window overlay attack, such as tapjacking, to escalate their privileges.
How can I mitigate CVE-2020-0099?
To mitigate CVE-2020-0099, it is recommended to update your Android device to the latest version available from Google.