Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android framework may let apps gain higher privileges

CVE-2021-0398 · published 5 years ago
Summary

The core Android system code (frameworks/base) can mistakenly start a foreground service, allowing a malicious app to elevate its permissions without the user’s knowledge. This could let the app act with the same rights as the user that launched it. Update the device to the latest security patches or contact the device vendor to ensure the fix is applied.

What to do
  • Update google platform/frameworks/base to version 11:2021-03-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 11:0, < 11:2021-03-01
Fix: upgrade to 11:2021-03-01
– google android 11.0
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
Original advisory text
In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges ...
In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
References
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published1 Mar 2021
Updated26 Oct 2026
First seen10 Sep 2026
Sources
ASB-A-173516292 · OSV
CVE-2021-0398 · NVD
Track software like this
Free during beta