Camera - Access to user location without any permissions

2024-01-0100:00:00

Google

osv.dev

camera

permissions bypass

information disclosure

user interaction

software

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CPENameOperatorVersion
platform/packages/apps/camera2eq11
platform/packages/apps/camera2eq13
platform/packages/apps/camera2eq12L
platform/packages/apps/camera2eq12
platform/packages/apps/camera2eq14

Name	Operator	Version
platform/packages/apps/camera2	eq	11
platform/packages/apps/camera2	eq	13
platform/packages/apps/camera2	eq	12L
platform/packages/apps/camera2	eq	12
platform/packages/apps/camera2	eq	14