ZeroDay Findings
Sign inSign up

Findings

CVE-2020-0227

In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check.

Published Jul 1, 2020 · updated Oct 13, 2026

In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 1, 2020 · Catalog

    Detected

    In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.

  2. Oct 13, 2026 · Catalog

    Fix available

    Android platform/cts 8.0:0 → 8.0:2020-07-01

  3. Oct 13, 2026 · Catalog

    Fix available

    Android platform/frameworks/base 8.0:0 → 8.0:2020-07-01

  4. Oct 13, 2026 · Catalog

    Fix available

    Android platform/cts 8.1:0 → 8.1:2020-07-01

  5. Oct 13, 2026 · Catalog

    Fix available

    Android platform/frameworks/base 8.1:0 → 8.1:2020-07-01

  6. Oct 13, 2026 · Catalog

    Fix available

    Android platform/cts 9:0 → 9:2020-07-01

  7. Oct 13, 2026 · Catalog

    Fix available

    Android platform/frameworks/base 9:0 → 9:2020-07-01

  8. Oct 13, 2026 · Catalog

    Fix available

    Android platform/cts 10:0 → 10:2020-07-01

  9. Oct 13, 2026 · Catalog

    Fix available

    Android platform/frameworks/base 10:0 → 10:2020-07-01

  10. Oct 13, 2026 · Catalog

    Updated

    In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

  • Android platform/cts10:0 → 10:2020-07-01
  • Android platform/cts8.0:0 → 8.0:2020-07-01
  • Android platform/cts8.1:0 → 8.1:2020-07-01
  • Android platform/cts9:0 → 9:2020-07-01
  • Android platform/frameworks/base10:0 → 10:2020-07-01
  • Android platform/frameworks/base8.0:0 → 8.0:2020-07-01
  • Android platform/frameworks/base8.1:0 → 8.1:2020-07-01
  • Android platform/frameworks/base9:0 → 9:2020-07-01

Sources

References