CVE-2021-0309: Medium severity Google Android vulnerability
In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 8.0:2021-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 8.1:2021-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 9:2021-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 10:2021-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2021-01-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-0309?
CVE-2021-0309 has a severity level of medium, indicating it could lead to local information disclosure and account access.
How do I fix CVE-2021-0309?
To mitigate CVE-2021-0309, users should update their Android devices to the latest security patches provided by Google.
Which Android versions are affected by CVE-2021-0309?
CVE-2021-0309 affects Android versions 8.0, 8.1, 9.0, 10.0, and 11.0.
Is user interaction required to exploit CVE-2021-0309?
Yes, user interaction is needed for exploitation of CVE-2021-0309.
What type of vulnerability is CVE-2021-0309 classified as?
CVE-2021-0309 is classified as a confused deputy vulnerability that may lead to information disclosure.