{"id":"CVE-2021-0932","aliases":["A-173025705","ASB-A-173025705","EUVD-2021-3551","GHSA-35cj-v3wc-rh8w"],"status":"published","title":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to...","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00125,"percentile":0.02221,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-11-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":"platform/frameworks/base","fixed_in":["10:2021-11-01"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/frameworks/base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-11-01"}]}],"versions":["10"]}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/security/bulletin/2021-11-01","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-0932"},{"url":"https://github.com/advisories/GHSA-35cj-v3wc-rh8w"},{"url":"https://android.googlesource.com/platform/frameworks/base/+/20c6f8d5945f78c14405b283a326dcfd611f9049","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2021-0932","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705","status":"published","published":"2021-12-15T18:05:19Z","modified":"2024-08-03T15:55:17.571Z","updated_at":"2026-11-02T14:33:10.887946Z"}],"euvd":[{"id":"EUVD-2021-3551","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705","status":"published","published":"2021-12-15T18:05:19Z","modified":"2024-08-03T15:55:17Z","updated_at":"2026-11-03T03:25:16.085901Z"}],"ghsa":[{"id":"GHSA-35cj-v3wc-rh8w","title":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to...","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705","status":"published","published":"2021-12-16T00:01:25Z","modified":"2023-02-01T05:07:09Z","updated_at":"2026-11-02T14:50:29.480738Z"}],"nvd":[{"id":"CVE-2021-0932","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705","status":"published","published":"2021-12-15T19:15:11.503Z","modified":"2026-06-17T03:30:40.8Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:02.189991Z"}],"osv":[{"id":"ASB-A-173025705","description":"In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2021-11-01T00:00:00Z","modified":"2026-11-11T16:12:36.322289056Z","updated_at":"2026-11-10T17:35:04.393608Z"}]}}