High · published December 8, 2025
⚡ A sneaky oversight in the EditFdnContactScreen.java allows an attacker to siphon off contacts from the work profile without needing user interaction! Think of it like a restaurant waiter who mistakenly hands over the entire guest list to someone just because they asked for a menu — no questions asked. This confusion can lead to sensitive information slipping into the wrong hands. An attacker could exploit this vulnerability to gain access to personal contacts stored in the work profile, which can be a goldmine of sensitive data. Imagine someone getting a hold of your professional contacts without even raising a finger! This could lead to serious privacy breaches and even targeted social engineering attacks.
Think of it like a restaurant waiter who mistakenly hands over the entire guest list to someone just because they asked for a menu — no questions asked. This confusion can lead to sensitive information slipping into the wrong hands. This vulnerability arises in the onActivityResult method where the application mistakenly allows access to work profile contacts due to improper privilege checks, effectively enabling unauthorized data access without requiring additional execution privileges.
An attacker could exploit this vulnerability to gain access to personal contacts stored in the work profile, which can be a goldmine of sensitive data. Imagine someone getting a hold of your professional contacts without even raising a finger! This could lead to serious privacy breaches and even targeted social engineering attacks. To remediate this, ensure your application is updated to the latest version where this issue is patched. Review the implementation of the onActivityResult method to tighten privilege checks and prevent unauthorized access to sensitive data. You've got this! By taking these steps, you'll help keep your users' data safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| google/android | all versions | — |
| google/android | all versions | — |