1-click MMI/USSD execution in Android via CALL_PHONE and browser-reachable dialer deeplinks (ACR Phone / com.nll.cb)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:41 UTC
Importiert: 2026-10-15 08:09 UTC
Quelle-ID: full_disc
uid_hash: efc21ca98bde16a715e5292b6742e2c94b8e7404498729fe0d613870b582f35b

Full Disclosure

Posted by Karan Saini on Oct 15 Android's CALL_PHONE permission, shown to users as "make and manage phone

calls", also authorises execution of carrier MMI/USSD codes against the SIM.

The permission text does not mention this, no confirmation is shown before

execution -- a transient "USSD code running" dialog appears only afterwards

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss