In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 30 Sep 2025 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* |
Thu, 04 Sep 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 04 Sep 2025 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| References |
|
MITRE
Status: PUBLISHED
Assigner: google_android
Published:
Updated: 2025-09-04T18:33:43.363Z
Reserved: 2021-08-23T19:27:46.249Z
Link: CVE-2021-39810
Vulnrichment
Updated: 2024-08-04T02:20:33.343Z
NVD
Status : Analyzed
Published: 2023-10-30T17:15:47.503
Modified: 2025-09-30T15:45:57.777
Link: CVE-2021-39810
Redhat
No data.
OpenCVE Enrichment
No data.