CVE-2021-39764: Input Validation
In Settings, there is a possible way to display an incorrect app name due to improper input validation. This could lead to local escalation of privilege via app spoofing with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-170642995
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Android 12L devices are affected. Exploitation requires local access and user interaction, so it is not described as remotely exploitable.
What does an attacker need to exploit it?
The attacker needs to use app spoofing to cause Settings to display an incorrect app name and must rely on user interaction. No additional execution privileges are needed.
What is the potential impact?
Successful exploitation could result in local escalation of privilege, with high confidentiality, integrity, and availability impact according to the supplied CVSS vector.
How can I determine whether a device may be affected?
Check whether the device is running Android 12L. The issue is tracked as Android ID A-170642995.