CoreCVE
Back

MEDIUM

In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a missing permission check

Published Oct 6, 2021

Description

In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-177927831

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner google_android
Published Oct 6, 2021
Updated Aug 3, 2024
Reserved Nov 6, 2020
Link CVE-2021-0686

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2021-0686

Red Hat

No data

ENISA EUVD

Assigner google_android
Published Oct 6, 2021
Updated Aug 3, 2024
Link EUVD-2021-3305

GitHub

No data