CVE-2024-36064

Name of the Vulnerable Software and Affected Versions com.nll.cb (aka ACR Phone) versions 0.330-playStore-NoAccessibility-arm8 and earlier

Description The issue allows any installed application, without requiring permissions, to place phone calls without user interaction. This is achieved by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component.

Recommendations For versions 0.330-playStore-NoAccessibility-arm8 and earlier, update to a patched version as soon as it is released. As a temporary workaround, consider restricting access to the com.nll.cb.dialer.dialer.DialerActivity component until a patch is available.