CVE-2022-20392: Input Validation

Published Sep 13, 2022

Updated

In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. This could lead to local escalation of privilege during app installation or upgrade with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-213323615

Affected Software

5 affected components

Google Android=10.0

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2022-09-01

Event History

Sep 13, 2022

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

DescriptionWeakness

Jun 5, 2025

Data Sourced

via Android·06:56 PM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-20392?

CVE-2022-20392 is considered a high severity vulnerability due to the potential for local escalation of privileges.

What versions of Android are affected by CVE-2022-20392?

CVE-2022-20392 affects Android versions 10.0, 11.0, 12.0, and 12.1.

How do I fix CVE-2022-20392?

To fix CVE-2022-20392, ensure that your Android device is updated to the latest security patches provided by Google.

What is the impact of CVE-2022-20392?

The impact of CVE-2022-20392 is the potential for dangerous permission access without user consent, allowing local privilege escalation.

Is CVE-2022-20392 related to app installation?

Yes, CVE-2022-20392 can lead to privilege escalation during app installation or upgrades due to improper input validation.