CVE-2021-0305

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-154015447

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-03067.8In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which alCVE-2021-03077.8In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused CVE-2021-03086.8In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatiCVE-2021-03095.5In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account aCVE-2021-03107.8In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to localCVE-2021-03116.5In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. ThiCVE-2021-03126.5In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote informCVE-2021-03137.5In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could leaCVE-2021-03147.3In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay atCVE-2021-03157.3In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account duCVE-2021-03169.8In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remoteCVE-2021-03177.8In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to loca
CVE-2021-0305: High severity, CVSS 7.8 | Vulnix