CVE-2019-2221

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138583650

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-22227.8n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2019-22237.8In ihevcd_ref_list of ihevcd_ref_list.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co CVE-2019-22258.8When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device CVE-2019-22265.5In device_class_to_int of device_class.cc, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2019-22276.5In DeepCopy of btif_av.cc, there is a possible out of bounds read due to improper casting. This could lead to remote information disclosure CVE-2019-22285.5In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disc CVE-2019-22295.5In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. This could lead to loca CVE-2019-22307.5In nfcManager_routeAid and nfcManager_unrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free. This could CVE-2019-22314.4In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information CVE-2019-22327.5In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of s CVE-2019-22336.8In getUserCount and getCount of UserSwitcherController.java, there is possible new user creation due to a logic error. This could lead to lo CVE-2019-22357.8Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto, Sn