{"id":"CVE-2020-8913","aliases":["EUVD-2020-29748","GHSA-c3x2-v6m7-xhgm"],"status":"published","title":"Local arbitrary code execution in splitinstall in Android's Play Core","description":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02883,"percentile":0.87039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-281"],"published":"2020-08-12T07:10:12Z","modified":"2026-06-17T03:27:10Z","products":[{"vendor":"android","product":"play_core_library"},{"vendor":"google llc","product":"android play core"}],"references":[{"url":"https://developer.android.com/reference/com/google/android/play/core/release-notes#1-7-2","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8913"},{"url":"https://github.com/advisories/GHSA-c3x2-v6m7-xhgm"}],"sources":{"cve":[{"id":"CVE-2020-8913","title":"Local arbitrary code execution in splitinstall in Android's Play Core","description":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.","status":"published","published":"2020-08-12T07:10:12Z","modified":"2024-08-04T10:12:10.972Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29748","description":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.","status":"published","published":"2020-08-12T07:10:12Z","modified":"2024-08-04T10:12:10Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:55.71159Z"}],"ghsa":[{"id":"GHSA-c3x2-v6m7-xhgm","title":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in...","description":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.","status":"published","published":"2022-05-24T17:25:27Z","modified":"2023-01-29T05:00:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:44:40.694561Z"}],"nvd":[{"id":"CVE-2020-8913","description":"A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.","status":"published","published":"2020-08-12T07:15:11.883Z","modified":"2026-06-17T03:27:10.557Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-281","CWE-22"],"updated_at":"2026-11-02T14:06:10.994748Z"}]}}