Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android framework may grant Activity Recognition without consent

CVE-2021-0306 · published 5 years ago
Summary

The core Android system code that manages app permissions can mistakenly give an app the Activity Recognition permission when the device is upgraded to a new Android version, without asking the user. This lets the app monitor physical activity and location without permission, potentially exposing personal data. Install the latest Android updates from Google as soon as they are available, which correct the permission‑grant logic, and keep devices and apps regularly patched.

What to do
  • Update google platform/frameworks/base to version 8.0:2021-01-01.
  • Update google platform/frameworks/base to version 8.1:2021-01-01.
  • Update google platform/frameworks/base to version 9:2021-01-01.
  • Update google platform/frameworks/base to version 10:2021-01-01.
  • Update google platform/frameworks/base to version 11:2021-01-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 8.0:0, < 8.0:2021-01-01
>= 8.1:0, < 8.1:2021-01-01
>= 9:0, < 9:2021-01-01
>= 10:0, < 10:2021-01-01
>= 11:0, < 11:2021-01-01
Fix: upgrade to 8.0:2021-01-01
– google android 8.0
8.1
9.0
10.0
11.0
cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*
Original advisory text
In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOG...
In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published1 Jan 2021
Updated3 Nov 2026
First seen17 Aug 2026
Sources
ASB-A-154505240 · OSV
CVE-2021-0306 · NVD
Track software like this
Free during beta