ASB-A-363248394

vendorUSosv

view advisory published 2025-01-01Licence: per source

In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-49742US	—	0.07% (0th)	—	2025-01-21
In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due to a missing permission check. This cou…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/packages/apps/Settings/+/b0eec6fdfd5b4f9ba81750da468d26440904142eFIX
https://source.android.com/security/bulletin/2025-01-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan