Screenshot Vulnerability in ASUS ZenFone 3 Max Android Device by ASUS

CVE-2018-14980

Summary

The ASUS ZenFone 3 Max Android device features an improper access control vulnerability in the system_server process, allowing malicious applications to capture screenshots without user consent. This exploit can be triggered by any co-located app, enabling it to initiate a screenshot operation and save the image to external storage. Additionally, if the attacking app obtains EXPAND_STATUS_BAR permission, it can manipulate the device to wake it up, revealing sensitive notifications, including two-factor authentication messages, even if the device is locked. The core android framework's inability to disable this process highlights a significant security concern, as it exposes users to potential information leakage and misuse of their private data.

References