Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android AlertReceiver.java Missing Permission Check Allows Local Escalation

CVE-2021-0985 · published 4 years ago
Summary

An issue in Android's AlertReceiver.java allows a malicious app to bypass security checks and gain elevated privileges on a device, without requiring user interaction or additional permissions. This could potentially be exploited by a malicious app, so users should be cautious when installing apps and ensure they come from trusted sources.

What to do
  • Update google platform/packages/apps/calendar to version 12:2021-12-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/apps/calendar >= 12:0, < 12:2021-12-01
Fix: upgrade to 12:2021-12-01
– google android 12.0
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Original advisory text
In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of privilege with no additional execution...
In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published1 Dec 2021
Updated8 Oct 2026
First seen18 Mar 2026
Sources
PUB-A-190403923 · OSV
CVE-2021-0985 · NVD
Track software like this
Free during beta