PT-2020-10854
CVE-2019-2089
·
Published
2020-03-15
·
Updated
2020-08-24
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Android versions Android-10
Description
In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Recommendations
For Android version Android-10, consider restricting the use of shared app IDs to minimize the risk of exploitation until a patch is available. As a temporary workaround, ensure that all permissions are manually reviewed and removed when uninstalling apps to prevent potential privilege escalation.
Found an issue in the description? Have something to add? Feel free to write us 👾