Vulnerability Intelligence Report
Local arbitrary code execution in splitinstall in Android's Play Core
CVE-2020-8913
A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.9
Impact Score:5.9
EPSS Probability:2.88%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-281 ↗CWE-281 Improper Preservation of Permissions
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Google LLC | Android Play Core | stable < 1.7.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.883%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Google LLC · Vendor · USA |
| Reserved | 2020-02-12T00:00:00 |
| Published | 2020-08-12T07:10:12 |
| Last Updated | 2024-08-04T10:12:10 |
Community Chatter & Buzz