CVE-2021-39796: High severity Google Android vulnerability
In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-205595291
Affected Software
Event History
Frequently Asked Questions
What access and user actions are required for exploitation?
An attacker needs local access with user-level execution privileges. Exploitation also requires the victim to interact with a tapjacking or overlay interface.
What is the likely impact if exploitation succeeds?
A successful attack can trick the victim into installing a harmful application and may result in local elevation of privilege. Confidentiality, integrity, and availability are all rated as high impact in the provided CVSS vector.
Which Android releases are listed as affected?
The affected releases listed are Android 10, Android 11, Android 12, and Android 12L.