Android Autofill data disclosure and local privilege escalation via tapjacking
Autofill data on Android phones can be taken by other apps.
Summary
Several places in Android let an attacker trick users, through a tapjacking or overlay attack, into revealing Autofill contents. This could lead to local privilege escalation, and the source says no user interaction is needed for exploitation.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen