CVE-2021-0569: Medium severity Google Android vulnerability
In onStart of ContactsDumpActivity.java, there is possible access to contacts due to a tapjacking/overlay attack. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/providers/ContactsProviderto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
Exploitation requires local user-level execution and user interaction. The issue is triggered through a tapjacking or overlay attack.
What information could be exposed?
The reported impact is disclosure of contacts information. The vulnerability does not list integrity or availability effects.
Which Android version is identified as affected?
The provided affected-version information identifies Android 11.
How can I identify this issue in Android tracking systems?
The Android issue identifier is A-174045870. The affected component is the ContactsProvider package, specifically ContactsDumpActivity.java.