CVE-2020-15165criticalCWE-506

CVE-2020-15165: critical vulnerability in maxieds ChameleonMiniLiveDebugger

Potentially tampered sources on Play Store for Chameleon Mini Live Debugger

Published · Updated

Follow this CVE+ Monitor ChameleonMiniLiveDebugger

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 1.3%
In short

A malicious actor may have tampered with the Chameleon Mini Live Debugger app (version 1.1.6-free) on Google Play Store, potentially injecting harmful code or requesting dangerous permissions. Users should immediately update to version 1.1.8 or later to ensure their device is not compromised.

Technical detail

CWE-506 describes supply chain compromise where application sources or permissions may have been altered by an unauthorized third party in the official distribution channel. The attack vector is installation of a tampered binary from the Play Store; the impact includes potential arbitrary code execution and unauthorized access to device resources depending on what malicious modifications were introduced.

Summary generated and translated by AI from the official description.
Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
maxieds · ChameleonMiniLiveDebugger