Loading...
Loading...
Researchers disclosed CVE-2022-20448, a vulnerability in Android’s NotificationManagerService that allowed accessibility services like TalkBack to receive notification content from background users. Missing a user check let foreground screen readers read notifications belonging to other profiles, potentially exposing sensitive data such as 2FA codes. Google fixed the issue in the November 2022 security bulletin by adding an isNotificationForCurrentUser() validation and a unit test, and awarded a $5,000 bounty for the June 2022 report. The patch restores user isolation for accessibility broadcasts and reduces cross-profile data leakage risk.
This vulnerability shows how missing user checks in system services can break profile isolation and leak sensitive notification content to accessibility services. Tech professionals must ensure platform services enforce user boundaries to protect data like 2FA codes and personal messages.
Dossier last updated: 2026-05-19 01:48:01
时隔三年重返iPhone：依然足够好用，但跟安卓旗舰差异不大了
A missing user check in Android’s NotificationManagerService allowed accessibility events for notifications belonging to background users to be dispatched to screen readers and other accessibility services, leaking private content across user profiles. The flaw (CVE-2022-20448) meant TalkBack or any registered accessibility service on the foreground session could read notification text from a different user—exposing sensitive data like 2FA codes. Google fixed it by adding an isNotificationForCurrentUser() check and a unit test, issued patches in the November 2022 Android Security Bulletin, and paid a $5,000 bug bounty after the June 29, 2022 report. The patch restores user isolation for accessibility broadcasts and reduces cross-profile data exposure.
抖音看到一个安卓微信问题, 在聊天对话框同时打开两个图片， APP 退出
Finally, texts between Android and iPhone users can be end-to-end encrypted