Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Android Runtime may expose local data

CVE-2022-20502 · published 3 years ago
Summary

The Android Runtime library (ART) can accidentally reveal information stored on the device because it reuses memory that should have been cleared. This happens without any special permissions or user actions, so a malicious app could read data it shouldn't. Update the system or apply the latest security patch to fix the issue.

What to do
  • Update google platform/art to version 13:2022-12-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/art >= 13:0, < 13:2022-12-01
Fix: upgrade to 13:2022-12-01
– google android 13.0
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
Original advisory text
In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local information disclosure with no additional execution privileges need...
In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published1 Dec 2022
Updated26 Oct 2026
First seen10 Sep 2026
Sources
ASB-A-222166527 · OSV
CVE-2022-20502 · NVD
Track software like this
Free during beta