CVE-2021-39663: High severity Google Android vulnerability
In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-200682135
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 10 are identified as affected. Exploitation is local, so an attacker needs the ability to execute code on the device as a user-level process.
Does exploitation require user interaction or elevated privileges?
No user interaction is required. The CVSS vector indicates low privileges are required, and the description states that User execution privileges are needed.
What is the potential impact if the issue is exploited?
Successful exploitation could allow local escalation of privilege through a bypass of a permissions check. The stated impact includes high confidentiality, integrity, and availability effects.