The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component.
The com.glitter.caller.screen.DialerActivity component is improperly exposed (CWE-732 — overly broad resource permissions) and lacks proper protection against unauthorized access (CWE-922 — storage of sensitive information in a publicly accessible resource). Any application installed on the device can send a specially crafted intent to this component, initiating a phone call without any user interaction or normally required system permissions (such as CALL_PHONE).
A malicious application can silently initiate expensive phone calls (e.g., to premium numbers) or calls to arbitrary numbers without the victim's knowledge, generating financial losses and violating user privacy.
Uninstall the application or apply patches available from the vendor according to references. Users should check for an updated version availability in the app store. MDM administrators should consider blocking installation of this application on corporate devices.
Application com.glitter.caller.screen (iCaller, Caller Theme & Dialer) version 1.1 and earlier on the Android platform.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N