CVE-2021-0506: High severity Google Android vulnerability
In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 8.1:2021-06-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 9:2021-06-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 10:2021-06-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-0506?
The severity of CVE-2021-0506 is classified as a medium risk due to the potential for local privilege escalation.
How do I fix CVE-2021-0506?
To fix CVE-2021-0506, users must update their Android devices to the latest available version that patches this vulnerability.
What versions of Android are affected by CVE-2021-0506?
CVE-2021-0506 affects Android versions 8.1, 9.0, 10.0, and 11.0.
What type of attack does CVE-2021-0506 exploit?
CVE-2021-0506 exploits a tapjacking/overlay attack which allows for a potential bypass of user interaction.
Is user interaction required to exploit CVE-2021-0506?
Yes, user interaction is needed for the exploitation of CVE-2021-0506.