CVE-2024-31310

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill service settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-313117.8In increment_annotation_count of stats_event.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loCVE-2024-313125.5In multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosuCVE-2024-313137.8In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead toCVE-2024-313145.5In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local deniaCVE-2024-313157.8In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificatCVE-2024-313167.8In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatchCVE-2024-313177.8In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to uCVE-2024-313187.8In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permissioCVE-2024-313197.8In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a conCVE-2024-313207.8In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation dCVE-2024-313227.8In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaininCVE-2024-313237.8In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead
CVE-2024-31310: High severity, CVSS 7.8 | Vulnix