CVE-2021-0386

EUVD-2021-3005 · Published Mar 10, 2021

In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173421110

Technologies

Google Android

Weaknesses

CWE-1021

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
v2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Privilege Escalation Stealth Credential Access Collection

T1190Exploit Public-Facing Application T1036.004Masquerade Task or Service T1056Input Capture T1548.004Elevated Execution with Prompt

References

https://source.android.com/security/bulletin/pixel/2021-03-01

Potentially impacted assets

See if this affects your attack surface