CVE-2021-39707

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12

Description In the onReceive method of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android versions Android-10 through Android-12, consider restricting access to the onReceive method of AppRestrictionsFragment.java to minimize the risk of exploitation. As a temporary workaround, consider disabling the functionality that allows starting a phone call without permissions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.