CVE-2021-0309: Medium severity Google Android vulnerability

Published Jan 4, 2021

Updated

In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158480899.

Affected Software

6 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

Event History

Jan 4, 2021

CVE Published

via Android·12:00 AM

Jan 11, 2021

CVE Published

via MITRE·09:47 PM

Data Sourced

via MITRE·09:47 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-0309?

CVE-2021-0309 has a severity level of medium, indicating it could lead to local information disclosure and account access.

How do I fix CVE-2021-0309?

To mitigate CVE-2021-0309, users should update their Android devices to the latest security patches provided by Google.

Which Android versions are affected by CVE-2021-0309?

CVE-2021-0309 affects Android versions 8.0, 8.1, 9.0, 10.0, and 11.0.

Is user interaction required to exploit CVE-2021-0309?

Yes, user interaction is needed for exploitation of CVE-2021-0309.

What type of vulnerability is CVE-2021-0309 classified as?

CVE-2021-0309 is classified as a confused deputy vulnerability that may lead to information disclosure.