CVE-2021-39706

HIGH

Android - Local Privilege Escalation via CredentialStorage Cleanup

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-39706. PoCs published by Trinadh465.

AI-analyzed exploit summary This repository contains source code files from the Android Open Source Project (AOSP) Settings app, specifically targeting CVE-2021-39706. The files appear to be part of a vulnerability analysis or patch diff, focusing on the Settings application components. No exploit code is present, but the files provide technical context for the vulnerability.

Description

In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-200164168

Exploits (1)

nomisec WRITEUP
by Trinadh465 · poc
https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2021-39706

This repository contains source code files from the Android Open Source Project (AOSP) Settings app, specifically targeting CVE-2021-39706. The files appear to be part of a vulnerability analysis or patch diff, focusing on the Settings application components. No exploit code is present, but the files provide technical context for the vulnerability.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Android Open Source Project (AOSP) Settings app, version 10 (r33)
No auth needed
Prerequisites: Access to the vulnerable AOSP Settings app
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://source.android.com/security/bulletin/2022-03-01

Scores

CVSS v3 7.8
EPSS 0.0062
EPSS Percentile 44.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-862
Status published
Products (3)
google/android 10.0
google/android 11.0
google/android 12.0
Published Mar 16, 2022
Tracked Since Feb 18, 2026