Intent Security Bypass in Android Account Manager by Google

CVE-2024-40676

Summary

A vulnerability in the checkKeyIntent method of the AccountManagerService.java code allows for the bypass of intent security checks. This flaw could enable the installation of unauthorized applications through a confused deputy attack, resulting in local privilege escalation. Notably, the exploit does not require user interaction, which heightens the risk of unauthorized access to sensitive functionalities within the affected Android ecosystem.

References