Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Android Wi‑Fi can be activated without user consent

CVE-2021-0523 · published 5 years ago
Summary

The Wi‑Fi settings screen in some Android versions can be tricked into turning on Wi‑Fi when a malicious overlay is placed over the screen. This could let a local attacker gain higher privileges after the user clicks. Update the device to the latest software and avoid installing apps from untrusted sources to reduce the risk.

What to do
  • Update google platform/packages/apps/settings to version 10:2021-06-01.
  • Update google platform/packages/apps/settings to version 11:2021-06-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/apps/settings >= 10:0, < 10:2021-06-01
>= 11:0, < 11:2021-06-01
Fix: upgrade to 10:2021-06-01
– google android 10.0
11.0
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
Original advisory text
In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege ...
In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
References
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1021Improper Restriction of Rendered UI Layers or Frames
Timeline
Published1 Jun 2021
Updated22 Oct 2026
First seen10 Sep 2026
Sources
ASB-A-174047492 · OSV
CVE-2021-0523 · NVD
Track software like this
Free during beta