CVE-2020-0394: High severity Google Android vulnerability

Published Sep 8, 2020

Updated

In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-155648639

Affected Software

5 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android

Event History

Sep 8, 2020

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 17, 2020

CVE Published

via MITRE·03:47 PM

Data Sourced

via MITRE·03:47 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-0394?

The severity of CVE-2020-0394 is classified as a moderate vulnerability, potentially allowing local escalation of privilege.

How do I fix CVE-2020-0394?

To fix CVE-2020-0394, users should update their Android devices to a patched version provided by Google.

Which versions of Android are affected by CVE-2020-0394?

CVE-2020-0394 affects Google Android versions 8.0, 8.1, 9.0, and 10.0.

What kind of exploit does CVE-2020-0394 enable?

CVE-2020-0394 enables a tapjacking exploit, allowing untrusted devices to gain access to contact lists.

Is user interaction required for exploiting CVE-2020-0394?

Yes, user interaction is required for exploiting CVE-2020-0394.