CVE-2019-2193

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In WelcomeActivity.java and related files, there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege, leaving an Admin app installed with no indication to the user, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-132261064

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-21947.8In SurfaceFlinger::createLayer of SurfaceFlinger.cpp, there is a possible arbitrary code execution due to improper casting. This could lead CVE-2019-21957.8In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could le CVE-2019-21965.5In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileg CVE-2019-21975.5In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could CVE-2019-21985.5In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional ex CVE-2019-21996.7In createSessionInternal of PackageInstallerService.java, there is a possible permissions bypass. This could lead to local escalation of pri CVE-2019-22007.3In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app CVE-2019-22017.8In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This co CVE-2019-22027.8In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca CVE-2019-22037.8In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca CVE-2019-22049.8In FindSharedFunctionInfo of objects.cc, there is a possible out of bounds read due to a mistake in AST traversal. This could lead to remote CVE-2019-22059.8In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free. This could lead to