CVE-2018-9524

HIGH

Android 7.0-8.1 - Unauthenticated Local Privilege Escalation via Overlay Window

Title source: llm
STIX 2.1

Description

In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105848
Patch, Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2018-11-01

Scores

CVSS v3 7.8
EPSS 0.0018
EPSS Percentile 7.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-1021
Status published
Products (5)
google/android 7.0
google/android 7.1.1
google/android 7.1.2
google/android 8.0
google/android 8.1
Published Nov 14, 2018
Tracked Since Feb 18, 2026