Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

Android framework may show notifications on lock screen

CVE-2021-39628 · published 4 years ago
Summary

A coding mistake in the Android system files can cause notification details to appear on a locked device, allowing anyone with physical access to read private information. No special permissions or user interaction are required. Apply the latest system update or patch from the vendor to correct the logic error.

What to do
  • Update google platform/frameworks/base to version 10:2022-01-01.
  • Update google platform/frameworks/base to version 11:2022-01-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 10:0, < 10:2022-01-01
>= 11:0, < 11:2022-01-01
Fix: upgrade to 10:2022-01-01
– google android 10.0
11.0
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
Original advisory text
In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional exec...
In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published1 Jan 2022
Updated26 Oct 2026
First seen10 Sep 2026
Sources
ASB-A-189575031 · OSV
CVE-2021-39628 · NVD
Track software like this
Free during beta