CVE-2021-0388

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local escalation of privilege resulting in attributing video call data to the wrong app, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162741489

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-03897.8In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilegeCVE-2021-03907.8In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permissionCVE-2021-03917.8In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due tCVE-2021-03927.8In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with User CVE-2021-03937.8In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead toCVE-2021-03945.5In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could CVE-2021-03957.8In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free. This could lead to local escalatCVE-2021-03969.8In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incCVE-2021-03979.8In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code executiCVE-2021-03987.8In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to locaCVE-2021-03997.8In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privCVE-2021-04005.5In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to eme
CVE-2021-0388: High severity, CVSS 7.8 | Vulnix