Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-1034: Google Android frameworks may expose installed apps

CVE-2021-1034 · published 4 years ago

Summary

The core Android framework code (PhoneInterfaceManager) does not verify permissions before revealing whether another app is installed. This lets any app on the device discover installed applications without user consent, creating a privacy leak. Updating the device to a version that includes the permission check or applying the vendor’s patch resolves the issue.

What to do

Update google platform/frameworks/base to version 12:2021-12-01.

Affected software

Ecosystem	Vendor	Product	Affected versions
Android	google	platform/frameworks/base	>= 12:0, < 12:2021-12-01 Fix: upgrade to 12:2021-12-01
–	google	android	12.0 `cpe:2.3:o:google:android:12.0:::::::*`

Original advisory text

In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions due to a missing permission check...

In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is a
possible way to determine whether an app is installed, without query
permissions due to a missing permission check. This could lead to local
information disclosure with no additional execution privileges needed. User
interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2021-12-01 Vendor Advisory
https://source.android.com/security/bulletin/pixel/2021-12-01 Patch Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/f4d8bd16b7788abd2631... Patch

Severity

3.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published1 Dec 2021

Updated4 Nov 2026

First seen8 Sep 2026

Sources

PUB-A-193441322 · OSV

CVE-2021-1034 · NVD

Track software like this

Free during beta