BG.Studio Color Phone Call Screen App Intent-Based Call Placing Vulnerability

A vulnerability in the Color Phone Call Screen App (com.asianmobile.callcolor) for Android, up to version 24, allows any application to place phone calls without user interaction. This is achieved by sending a crafted intent to the exported CallActivity component, bypassing normal permission requirements.

Impact

Exploitation of this vulnerability enables unauthorized phone calls to be placed from the affected device, without the user's consent.

Reproduction

The vulnerability can be reproduced by sending a crafted intent to the com.asianmobile.callcolor.ui.component.call.CallActivity component from any application installed on the device. This can be done without any special permissions, allowing the malicious app to place phone calls on behalf of the user, without their knowledge or consent.