Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2020-0415: SystemUI may expose contact data without user interaction
CVE-2020-0415 · published 6 years ago
Summary
The Android SystemUI component can unintentionally share contact information to other apps on the device. An attacker with basic user-level access could read this data without needing the user to click anything. Apply the latest system updates from Google to resolve the issue.
What to do
- Update google platform/frameworks/base to version 8.0:2020-10-01.
- Update google platform/frameworks/base to version 8.1:2020-10-01.
- Update google platform/frameworks/base to version 9:2020-10-01.
- Update google platform/frameworks/base to version 10:2020-10-01.
- Update google platform/frameworks/base to version 11:2020-10-01.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | platform/frameworks/base |
>= 8.0:0, < 8.0:2020-10-01 >= 8.1:0, < 8.1:2020-10-01 >= 9:0, < 9:2020-10-01 >= 10:0, < 10:2020-10-01 >= 11:0, < 11:2020-10-01 Fix: upgrade to 8.0:2020-10-01
|
|
| – | android |
8.0 8.1 9.0 10.0 11.0 cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* |
Original advisory text
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privilege...
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Timeline
Published1 Oct 2020
Updated26 Oct 2026
First seen3 Sep 2026
Track software like this
Free during beta