CVE-2021-0307

In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused deputy. This could lead to local escalation of privilege allowing a malicious app to silently gain access to a dangerous permission with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Android ID: A-155648771.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.17% chance of exploitation in the next 30 days, 6th percentile

Published

2021-01-11

Updated

2024-08-03

Proof-of-concept exploits (1)

• SpiralBL0CK/Guide-and-theoretical-code-for-CVE-2023-356742★ · 2024-10-15

References

• CVE Record
• NVD entry

Related

• CVE-2021-0302
• CVE-2021-0308
• CVE-2021-0253
• CVE-2021-0313
• CVE-2021-0252
• CVE-2021-0315