CVE-2021-0304

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user's contacts with User execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-8.0, Android-8.1, Android-9; Android ID: A-162738636.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-03057.8In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilegCVE-2021-03067.8In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which alCVE-2021-03077.8In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused CVE-2021-03086.8In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatiCVE-2021-03095.5In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account aCVE-2021-03107.8In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to localCVE-2021-03116.5In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. ThiCVE-2021-03126.5In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote informCVE-2021-03137.5In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could leaCVE-2021-03147.3In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay atCVE-2021-03157.3In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account duCVE-2021-03169.8In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote
CVE-2021-0304: Medium severity, CVSS 5.5 | Vulnix