VulnerabilityAnalyzed
CVE-2024-31316
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch.
HIGH 7.8EPSS 0.11%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.11% probability · 1th percentile
- CISA KEV
- Not listed
- Affected
- google/android
- Source
- security@android.com
References
- https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9Mailing List, Patch
- https://source.android.com/security/bulletin/2024-06-01Patch, Vendor Advisory
- https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9Mailing List, Patch
- https://source.android.com/security/bulletin/2024-06-01Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.