CVE-2020-0419

In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check

published October 14, 2020

CVSS
—
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-142125338

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Published
2020-10-14T13:02Z
EPSS history
Timeline
  • 14 OCT 13:02Z
    In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check
    cvelistv5