high7.8

CVE-2024-40657

In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy.

Impact

In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 12.0, 12.1, 13.0, 14.0

Weakness classification

CWE-269

References

NVD record
CVE.org record
https://android.googlesource.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603
https://source.android.com/security/bulletin/2024-09-01