CVE-2021-0302: 
NixOS vulnerability analysis and mitigation

In PackageInstaller for Android versions 8.1, 9, and 10, there exists a vulnerability identified as CVE-2021-0302 that involves a potential tapjacking attack due to an insecure default value. The vulnerability was disclosed in the February 2021 Android Security Bulletin (Android Bulletin).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is categorized under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). The vulnerability requires local access and user interaction for exploitation, but does not require additional execution privileges (NVD).

If successfully exploited, this vulnerability could lead to local escalation of privilege and unauthorized access to permissions. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction for exploitation, making it somewhat more difficult to exploit. The attack requires local access to the device, and no additional execution privileges are needed for exploitation (CVE).

The vulnerability was addressed in the February 2021 Android Security Bulletin. Users of affected Android versions (8.1, 9, and 10) should apply the security updates provided through their device manufacturers (Android Bulletin).