{"id":"PUB-A-180104327","details":"In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-180104327","CVE-2021-0992"],"modified":"2026-05-29T15:55:33.750044621Z","published":"2021-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/b2c03474c459a694e2f434160a6c3da17f5b1a4f"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2021-12-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/b2c03474c459a694e2f434160a6c3da17f5b1a4f"],"spl":"2021-12-01","vanir_signatures":[{"signature_version":"v1","id":"PUB-A-180104327-f01603a0","deprecated":false,"digest":{"function_hash":"104485141637095859179282170470878313838","length":404},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b2c03474c459a694e2f434160a6c3da17f5b1a4f","signature_type":"Function","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java","function":"onCreate"}},{"signature_version":"v1","id":"PUB-A-180104327-f5c18cd5","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b2c03474c459a694e2f434160a6c3da17f5b1a4f","digest":{"threshold":0.9,"line_hashes":["81542683022710382001647597058075622701","194994758474799553814890042146196583243","339244979075647213363104715871245383497","102277680394259784822421726305699026436","267444333987596431965299598945611135494","42632513904164290136329403539816671648","12467150003188855140878124554568115988"]},"signature_type":"Line","deprecated":false,"target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}],"severity":"Moderate","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-180104327.json"}}],"schema_version":"1.7.5"}