CVE-2021-0569 Other in Android

Medium 5.0 Published Updated

Attackers can use tapjacking to trick users into exposing contacts in the Android ContactsDumpActivity, leading to local information disclosure.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Local or same network only
Victim action needed
A user has to click or open something
Fix
Available

What is CVE-2021-0569?

CVE-2021-0569 is a medium-severity vulnerability in Google Android, published on 22 Jun 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In onStart of ContactsDumpActivity.java, there is possible access to contacts due to a tapjacking/overlay attack. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174045870

Weakness: CWE-1021

Which versions are affected by CVE-2021-0569?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2021-0569?

Apply the vendor's patch.

Is CVE-2021-0569 being exploited?

There is no known exploitation of CVE-2021-0569 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as A-174045870, GHSA-gx5m-c6q5-vhp7, PUB-A-174045870.

Is CVE-2021-0569 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free