CVE-2020-0014

MEDIUM

Android 8.0-10 - Unauthenticated Privilege Escalation via TYPE_TOAST Window Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2020-0014. PoCs published by tea9, doudoudedi.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2020-0014, demonstrating how a malicious Android app can create a clickable Toast overlay to intercept user touch events and potentially steal sensitive information. The exploit modifies Toast window parameters to remove FLAG_NOT_TOUCHABLE, making it full-screen and clickable.

Description

It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520

Exploits (2)

nomisec WORKING POC 7 stars
by tea9 · poc
https://github.com/tea9/CVE-2020-0014-Toast

This repository contains a proof-of-concept exploit for CVE-2020-0014, demonstrating how a malicious Android app can create a clickable Toast overlay to intercept user touch events and potentially steal sensitive information. The exploit modifies Toast window parameters to remove FLAG_NOT_TOUCHABLE, making it full-screen and clickable.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Android 8.0, 8.1, 9, 10
No auth needed
Prerequisites: Android device with vulnerable OS version · Ability to install malicious app
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by doudoudedi · poc
https://github.com/doudoudedi/CVE-2020-0014_Toast

This PoC demonstrates CVE-2020-0014, a vulnerability in Android's Toast notification system that allows an overlay attack by manipulating Toast window parameters to create a clickable, full-screen overlay. The exploit uses reflection to modify Toast's internal fields, enabling touch event interception.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Android (versions affected by CVE-2020-0014)
No auth needed
Prerequisites: Android device with vulnerable Toast implementation · Ability to install and run the malicious app
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 5.5
EPSS 0.0096
EPSS Percentile 57.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-1021
Status published
Products (4)
google/android 8.0
google/android 8.1
google/android 9.0
google/android 10.0
Published Feb 13, 2020
Tracked Since Feb 18, 2026