Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Android can reveal installed apps without permission

CVE-2021-1025 · published 4 years ago
Summary

A function in Android’s core system code can be tricked into confirming whether a specific app is installed, even if the checking app lacks the normal permission to query other apps. This lets a malicious app learn what other software is on the device without the user’s knowledge. Install the latest Android updates or apply the vendor’s security patch to close the gap.

What to do
  • Update google platform/frameworks/base to version 12:2021-12-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 12:0, < 12:2021-12-01
Fix: upgrade to 12:2021-12-01
– google android 12.0
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Original advisory text
In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead...
In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published1 Dec 2021
Updated8 Oct 2026
First seen8 Sep 2026
Sources
PUB-A-193800652 · OSV
CVE-2021-1025 · NVD
Track software like this
Free during beta