Hijacking Vulnerability in Customization Service Prior to Android R(11.0)

Hijacking Vulnerability in Customization Service Prior to Android R(11.0)

CVE-2021-25373 · HIGH Severity

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.

Learn more about our Cis Benchmark Audit For Google Android.