CVE-2022-20214

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-26 · updated 2026-06-17
Weakness: CWE-1021

Description

In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210

Affected products

Android: 10.0, 11.0, 12.0

References

https://source.android.com/security/bulletin/aaos/2023-01-01
https://source.android.com/security/bulletin/aaos/2023-01-01

Get alerted when CVE-2022-20214 or the next vulnerability affects your stack