GeniusTools Color Phone Call Screen Theme Unintended Outgoing Call Vulnerability

A vulnerability in the Color Phone: Call Screen Theme application, specifically in version 21.1.9 for Android, allows any app to make phone calls without user interaction. This is achieved by sending a crafted intent to the exported DialerActivity component, bypassing normal permission requirements.

Impact

Exploitation of this vulnerability enables unauthorized applications to place phone calls on behalf of the user, without their consent or knowledge.

Reproduction

The vulnerability can be reproduced by sending a crafted intent to the com.remi.colorphone.callscreen.calltheme.callerscreen.dialer.DialerActivity component. This can be done from any application installed on the device, as no special permissions are required.