CVE-2024-53931

> The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android
> enables any application (with no permissions) to place phone calls
> without user interaction by sending a crafted intent via the
> com.glitter.caller.screen.DialerActivity component.
> ------------------------------------------
>
> [Vulnerability Type]
> Insecure Permissions
>
> ------------------------------------------
>
> [Vendor of Product]
> Wallfinity: Lovely Caller Theme
>
> ------------------------------------------
>
> [Affected Product Code Base]
> "iCaller, Caller Theme & Dialer" com.glitter.caller.screen - Version 1.1
>
> ------------------------------------------
>
> [Affected Component]
> Exported "com.glitter.caller.screen.DialerActivity" component in the com.glitter.caller.screen Android
> application
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> Malicious third-party apps installed on the device can invoke the exported DialerActivity by sending
> crafted intents. This allows them to place outgoing calls without the user's consent (with no permissions)
>
> ------------------------------------------
>
> [Reference]
> https://play.google.com/store/apps/details?id=com.glitter.caller.screen
> https://github.com/actuator/com.glitter.caller.screen/blob/main/com.glitter.caller.screen.DialerActivity-1.1.gif
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren