CVE-2021-0391: 
NixOS vulnerability analysis and mitigation

In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account without permissions due to a tapjacking/overlay attack. The vulnerability, identified as CVE-2021-0391, affects Android versions 8.1, 9, 10, and 11. This security issue was disclosed in March 2021 as part of the Android Security Bulletin (Android Bulletin).

The vulnerability is classified as an improper restriction of rendered UI layers or frames (CWE-1021). It received a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack requires local access and user interaction but does not need any privileges for exploitation (NVD).

If successfully exploited, this vulnerability could lead to local escalation of privilege. The attacker could potentially learn about the existence of accounts on the device without having the necessary permissions, compromising user privacy and security (NVD).

The vulnerability requires user interaction for exploitation and local access to the device. The attacker needs to execute a tapjacking or overlay attack targeting the ChooseTypeAndAccountActivity component (NVD).

The vulnerability was addressed in the March 2021 Android Security Bulletin. Users should update their Android devices to the latest available security patch level to protect against this vulnerability (Android Bulletin).