CVE-2020-0386

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description A possible tapjacking vector exists due to an insecure default value in the onCreate method of RequestPermissionActivity.java. This could lead to local escalation of privilege, allowing an attacker to set Bluetooth discoverability with user execution privileges needed. User interaction is required for exploitation.

Recommendations For Android versions 8.0 through 11, consider restricting the use of the RequestPermissionActivity until a patch is available. As a temporary workaround, avoid using the onCreate method of RequestPermissionActivity.java to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.