CVE-2020-10836: Critical severity Google Android vulnerability
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The Widevine Trustlet allows read and write operations on arbitrary memory locations. The Samsung ID is SVE-2019-15873 (February 2020).
Affected Software
Event History
Frequently Asked Questions
Which devices are affected?
The issue affects Samsung mobile devices using Exynos chipsets and running Android O (8.x), P (9.0), or Q (10.0).
What access does an attacker need to exploit this issue?
The supplied CVSS vector indicates exploitation is network-accessible, requires low attack complexity, and requires neither privileges nor user interaction.
What is the potential impact of successful exploitation?
The Widevine Trustlet can be made to perform read and write operations at arbitrary memory locations. The CVSS assessment rates confidentiality, integrity, and availability impact as high.
How can I identify the vendor tracking identifier for this issue?
Samsung tracks this issue as SVE-2019-15873, associated with its February 2020 security update information.