{"id":"ASB-A-172252122","details":"In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.","aliases":["A-172252122","CVE-2021-0446"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Contacts/+/448e2f1bf40d566aaeac9ac269eb3394225448bf"}],"affected":[{"package":{"name":"platform/packages/apps/Contacts","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-04-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Contacts/+/b423fdf941a10fc1498dcee0665e56fb1856bf4e"],"severity":"High","spl":"2021-04-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Contacts/+/b423fdf941a10fc1498dcee0665e56fb1856bf4e","target":{"file":"src/com/android/contacts/vcard/SelectAccountActivity.java"},"deprecated":false,"digest":{"line_hashes":["183985563741908556164829149660949894098","241248886362317539271647231456803582232","153458019161750203142924314518962119002"],"threshold":0.9},"id":"ASB-A-172252122-29de44d0"},{"digest":{"function_hash":"134876642430480815571771471292155310008","length":1795},"id":"ASB-A-172252122-63f02065","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Contacts/+/b423fdf941a10fc1498dcee0665e56fb1856bf4e","target":{"file":"src/com/android/contacts/vcard/ImportVCardActivity.java","function":"onCreate"},"deprecated":false},{"id":"ASB-A-172252122-78681a50","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Contacts/+/b423fdf941a10fc1498dcee0665e56fb1856bf4e","target":{"file":"src/com/android/contacts/vcard/SelectAccountActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"26447514833447817493690386448352045215","length":1224}},{"source":"https://android.googlesource.com/platform/packages/apps/Contacts/+/b423fdf941a10fc1498dcee0665e56fb1856bf4e","target":{"file":"src/com/android/contacts/vcard/ImportVCardActivity.java"},"deprecated":false,"digest":{"line_hashes":["26162171377046155041902594664831628231","6146462039492205448327261203358343556","239296934362288178396037879008712021905"],"threshold":0.9},"id":"ASB-A-172252122-ea104ea2","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172252122.json"}}],"schema_version":"1.9.0"}