CVE-2019-2200

CVE-2019-2200 is a permission bypass vulnerability in Android 10, specifically within the updatePermissions function of PermissionManagerService.java. This flaw allows a malicious application to acquire custom permissions from other apps, potentially leading to local escalation of privilege. Exploitation requires user interaction and local access, but can result in high impact to confidentiality, integrity, and availability. While rated with a CVSS score of 7.3 (HIGH), there is no known public exploit code (Metasploit, Nuclei, ExploitDB) and it is not listed on the CISA KEV catalog. Community discussion and media coverage are minimal, suggesting limited active exploitation or widespread attention.