CVE-2022-20214

MEDIUM

Android 10-12 - Tapjacking Attack via Car Settings Toggle Button

Title source: llm

Description

In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210

References (1)

Core 1

Core References

Vendor Advisory

https://source.android.com/security/bulletin/aaos/2023-01-01

Scores

CVSS v3 4.7

EPSS 0.0023

EPSS Percentile 13.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-1021

Status published

Products (3)

google/android 10.0

google/android 11.0

google/android 12.0

Published Jan 26, 2023

Tracked Since Feb 18, 2026