In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 187.0, "function_hash": "20019307612805279700070373041513461030" }, "id": "PUB-A-191772737-30764d06", "source": "https://android.googlesource.com/platform/frameworks/base/+/19a655d70c100253b5874f3d9b751877b348e5c4", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/pm/ShortcutService.java", "function": "isRequestPinItemSupported" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "292075990643606661094619884977815722966", "304524556732553160900539777446061845520", "240085421403021500153966743383886251911", "300472156381034102960503631097265191332", "43948770902719980270399135770899431815", "62782065868543866321021354731174660903", "72223295225094505236641656585160508020" ] }, "id": "PUB-A-191772737-d95ed19b", "source": "https://android.googlesource.com/platform/frameworks/base/+/19a655d70c100253b5874f3d9b751877b348e5c4", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/pm/ShortcutService.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/19a655d70c100253b5874f3d9b751877b348e5c4" ], "spl": "2021-12-01", "severity": "Moderate", "types": [ "ID" ] }