CVE-2021-0692
📋 TL;DR
This vulnerability allows local attackers to escalate privileges on Android devices by exploiting an unsafe PendingIntent in the FirstScreenBroadcast component. Attackers can launch arbitrary activities without user interaction, potentially gaining elevated access. Affects Android 9, 10, and 11 devices.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of malicious apps, data theft, and persistence as system-level malware.
Likely Case
Local privilege escalation enabling unauthorized access to sensitive system functions and user data.
If Mitigated
Limited impact if device is fully patched and has security controls like verified boot enabled.
🎯 Exploit Status
Exploitation requires local access to the device but no user interaction. The vulnerability is in a system component accessible to apps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2021-09-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/2021-09-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update. 2. Install the September 2021 Android security patch or later. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Disable unnecessary apps
androidRemove or disable apps that might exploit this vulnerability by restricting app installations to trusted sources only.
🧯 If You Can't Patch
- Restrict physical access to devices and implement mobile device management (MDM) controls.
- Monitor for suspicious app behavior and limit app permissions to minimum necessary levels.
🔍 How to Verify
Check if Vulnerable:
Check Android version and security patch level in Settings > About phone > Android version and Security patch level.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level is 2021-09-01 or later in Settings > About phone.📡 Detection & Monitoring
Log Indicators:
- Unusual activity launches from system components, particularly FirstScreenBroadcast-related events in system logs.
Network Indicators:
- Not applicable - this is a local privilege escalation vulnerability.
SIEM Query:
Not applicable for typical SIEM systems as this is a local Android vulnerability.