Vulnerabilities > CVE-2021-0963 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Google Android

047910
CVSS 7.1 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
local
low complexity
google
CWE-1021
NVD
Published: 2021-12-15
Updated: 2021-12-17

Summary

In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199754277

Vulnerable Configurations

Part Description Count
OS
Google
4

Common Weakness Enumeration (CWE)

References