CVE-2021-0933 Cross-site scripting in Android
Improper input validation in Android Bluetooth pairing dialogs allows HTML injection, potentially tricking users into pairing malicious devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-0933?
CVE-2021-0933 is a high-severity cross-site scripting vulnerability in Google Android, published on 15 Dec 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-172251622
Which versions are affected by CVE-2021-0933?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2021-0933?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-0933 being exploited?
There is no known exploitation of CVE-2021-0933 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as A-172251622, ASB-A-172251622, GHSA-pjhg-fc6g-4mjw.