CVE-2020-0267: Critical severity android vulnerability
In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app instead of the one the user intended, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-139128211
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 11 are affected. Exploitation is local and requires user interaction.
What does an attacker need to exploit it?
An attacker needs to cause the user to launch an app. The vulnerability may cause WindowManager to launch a malicious app instead of the app the user intended, without requiring additional execution privileges.
What is the potential impact?
Successful exploitation can result in local escalation of privilege with high confidentiality, integrity, and availability impact.
How can I identify the relevant fix?
The issue is tracked as Android ID A-139128211 and is covered by the Android 11 security bulletin published on 2020-09-17.