Permissions Bypass in Android Notification Manager Service

CVE-2019-2098

What is CVE-2019-2098?

This vulnerability resides in the NotificationManagerService's areNotificationsEnabledForPackage function, where a missing permissions check can result in a bypass. An attacker exploiting this flaw can escalate privileges locally without requiring additional permissions or user interaction, potentially compromising user data security and system integrity. The affected versions include Android 7.0, 7.1.x, 8.0, 8.1, and 9. For further information, please refer to the official source.

References