Vulnerability Description
The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window, aka internal bug 26677796.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android | 6.0 |
Related Weaknesses (CWE)
References
- http://source.android.com/security/bulletin/2016-06-01.htmlRelease NotesVendor Advisory
- https://android.googlesource.com/platform/frameworks/base/+/613f63b938145bb86cd6Patch
- https://android.googlesource.com/platform/frameworks/native/+/03a53d1c7765eeb3afPatch
- https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/2068cPatch
- http://source.android.com/security/bulletin/2016-06-01.htmlRelease NotesVendor Advisory
- https://android.googlesource.com/platform/frameworks/base/+/613f63b938145bb86cd6Patch
- https://android.googlesource.com/platform/frameworks/native/+/03a53d1c7765eeb3afPatch
- https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/2068cPatch
FAQ
What is CVE-2016-2496?
CVE-2016-2496 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially ove...
How severe is CVE-2016-2496?
CVE-2016-2496 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-2496?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android.