medium5.5

CVE-2024-43082

In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy.

Impact

In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 12.0, 12.1

Weakness classification

CWE-125

References

NVD record
CVE.org record
https://android.googlesource.com/platform/frameworks/base/+/6aa1b4fbf5936a1ff5bdbb79397c94910a6ed8f5
https://source.android.com/security/bulletin/2024-11-01