Technical intelligence and weaponization dossier for CVE-2020-0096. Documented exploitation across 1 active malware families totaling 0 analyzed telemetry samples.
| Vulnerability ID | CVE-2020-0096 |
|---|---|
| Common Name / Bulletin | Android StrandHogg 2.0 Task Affinity & Activity Hijacking Vulnerability (Android Security Bulletin — May 2020) |
| CWE Classification | CWE-1021: Improper Restriction of Rendered UI Layers or Frames |
| Affected Software & Versions | Android 8.0, 8.1, 9.0 |
| Technical Root Cause | Flaw in Android ActivityManagerService permitting malicious background applications to hijack tasks and overlay credential-harvesting phishing dialogs over legitimate banking apps by manipulating taskAffinity attributes. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2020-0096 in enterprise networks:
ActivityManager dumpsys output displaying foreign package task stacks assuming taskAffinity associated with financial institution packages.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →