CVE-2021-25357: 
NixOS vulnerability analysis and mitigation

A pendingIntent hijacking vulnerability was discovered in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10.0), and 3.6.80.7 in Android R(11.0). This vulnerability allows unprivileged applications to access contact information (Samsung Mobile, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Samsung Mobile assigned a slightly different score of 5.6 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability allows unprivileged applications to gain unauthorized access to contact information, potentially compromising user privacy and data confidentiality (NVD).

Samsung has addressed this vulnerability in the SMR APR-2021 Release 1 update. Users are advised to update their devices to this version or later to protect against this vulnerability (Samsung Mobile).