CVE-2020-0115: High severity Google Android vulnerability
In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-150038428
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access and User-level execution privileges. No user interaction is required.
Which Android releases are identified as affected?
Android 8.0, Android 8.1, Android 9, and Android 10 are listed as affected.
What is the practical impact of successful exploitation?
A malicious app may bypass settings controls and become the default handler for arbitrary domains, resulting in local privilege escalation with access to confidentiality, integrity, and availability impacts.
What should organizations do to remediate the issue?
Apply the available patch for the affected Android release.