CVE-2024-29748: high-severity vulnerability in Google Android
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A logic error in the code allows an attacker to bypass a security control and gain higher privileges on the system. This requires user interaction but no special permissions to start.
A logic error in privilege enforcement allows local privilege escalation (CWE-280: Improper Handling of Insufficient Permissions or Privileges). The vulnerability requires user interaction but necessitates no elevated starting privileges; an unprivileged local user can exploit this to gain higher execution context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.