{"id":"ASB-A-200288596","details":"In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-200288596","CVE-2021-39799"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/b716ef0497811c40f4908d657d3c9f99fa23595d"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-04-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["58500476833747802153434581479627834441","141003516130091699924838840649367207779","323974363854389601892241804885757787268","161203185256460395633060024710765614252","282530622468871108991748252371714399115","331704839110234400389262580757181032614","279945010626182010948792159391367305188","192652305326336604983534351473504759127","334977559813023621614033957333765289371","157628855462525407594729476251106386503"]},"id":"ASB-A-200288596-f8c312d7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f29223746d9009a592b0ee7ee5a92398589c5b53","target":{"file":"core/java/android/content/AttributionSource.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f29223746d9009a592b0ee7ee5a92398589c5b53"],"severity":"High","spl":"2022-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-200288596.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-04-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f29223746d9009a592b0ee7ee5a92398589c5b53"],"severity":"High","spl":"2022-04-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/android/content/AttributionSource.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["58500476833747802153434581479627834441","141003516130091699924838840649367207779","323974363854389601892241804885757787268","161203185256460395633060024710765614252","282530622468871108991748252371714399115","331704839110234400389262580757181032614","279945010626182010948792159391367305188","192652305326336604983534351473504759127","334977559813023621614033957333765289371","157628855462525407594729476251106386503"]},"id":"ASB-A-200288596-1f04f4a2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f29223746d9009a592b0ee7ee5a92398589c5b53"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-200288596.json"}}],"schema_version":"1.9.0"}