Race condition in Google Duo - #VU49848
Published: January 20, 2021
Vulnerability identifier: #VU49848
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a race condition within the way the mobile application implements WebRTC features for voice and video communications. A remote attacker can send specially crafted SDP messages to the affected device while the victim is trying to make a voice or video call and intercept video and audio fragments from the victim's phone before the call is accepted by the callee.
Affected software
Google Duo
Remediation
Install updates from vendor's website.
Google Duo - update to 115.0.345680794.DR115_RC02