CVE-2021-0306
📋 TL;DR
This vulnerability allows Android apps to bypass permission checks during major version upgrades, granting them the ACTIVITY_RECOGNITION permission without user consent. This enables local privilege escalation on affected Android devices. Users running Android 8.0 through 11 are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Malicious app gains permanent activity recognition permission, allowing continuous monitoring of user physical activities without detection or consent.
Likely Case
App silently obtains sensitive motion/activity data for profiling, advertising, or surveillance purposes.
If Mitigated
App fails to gain unauthorized permission; normal permission controls remain effective.
🎯 Exploit Status
Requires app installation and device OS upgrade timing; no user interaction needed once app is installed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Bulletin January 2021 patches
Vendor Advisory: https://source.android.com/security/bulletin/2021-01-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > Advanced > System update. 2. Install January 2021 or later security patch. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable automatic OS updates
androidPrevent automatic major version upgrades until patched
Settings > System > Advanced > System update > Turn off auto-download over Wi-Fi
Restrict app installations
androidOnly allow installations from trusted sources like Google Play Store
Settings > Security > Install unknown apps > Disable for all apps
🧯 If You Can't Patch
- Avoid upgrading Android major versions on affected devices
- Use mobile device management (MDM) to control app installations and monitor permission requests
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If version is 8.0-11 and security patch level is before January 2021, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level is January 2021 or later in Settings > About phone > Android security patch level.📡 Detection & Monitoring
Log Indicators:
- Unexpected permission grants during OS upgrade
- Apps requesting ACTIVITY_RECOGNITION without user prompts
Network Indicators:
- Unusual activity data exfiltration from apps with this permission
SIEM Query:
android.permission.ACTIVITY_RECOGNITION granted during system upgrade events