CVE-2021-33057

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the…

published July 26, 2022

CVSS
—
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01373 · 71.8th percentile
Published
2022-07-26T22:36Z
EPSS history
Timeline
  • 26 JUL 22:36Z
    The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the…
    cvelistv5