Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2021-0595: Google Android framework lets work profile be opened without PIN
CVE-2021-0595 · published 5 years ago
Summary
The core Android system code can be tricked into opening a work profile without requiring the user’s PIN after they have logged in. This means someone with access to the device could view work data they should not see. Apply the latest security updates from Google as soon as they are available to close the gap.
What to do
- Update google platform/frameworks/base to version 8.1:2021-09-01.
- Update google platform/frameworks/base to version 9:2021-09-01.
- Update google platform/frameworks/base to version 10:2021-09-01.
- Update google platform/frameworks/base to version 11:2021-09-01.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | platform/frameworks/base |
>= 8.1:0, < 8.1:2021-09-01 >= 9:0, < 9:2021-09-01 >= 10:0, < 10:2021-09-01 >= 11:0, < 11:2021-09-01 Fix: upgrade to 8.1:2021-09-01
|
|
| – | android |
8.1 9.0 10.0 11.0 cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* |
Original advisory text
In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege w...
In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8
High
Type
CWE-287Improper Authentication
Timeline
Published1 Sep 2021
Updated29 Oct 2026
First seen10 Sep 2026
Track software like this
Free during beta