What is CVE-2021-39808?

CVE-2021-39808 is a high-severity vulnerability in Google Android, classified under Missing Authorization. CVSS score: 7.8/10. Published 2022-04-12.

How severe is CVE-2021-39808?

High severity. CVSS v3 base score is 7.8 out of 10.

Auth bypass in Google Android

CVE-2021-39808

In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209966086

Vulnerability class: Broken Access Control

EPSS: 0.001 (1.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Google Android — versions 10.0, 11.0, 12.0
N/a Android — versions Android-10 Android-11 Android-12

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@android.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-39808?: CVE-2021-39808 is a high-severity vulnerability in Google Android, classified under Missing Authorization. CVSS score: 7.8/10. Published 2022-04-12.
How severe is CVE-2021-39808?: High severity. CVSS v3 base score is 7.8 out of 10.