← Saturday, October 10, 2026SecurityVulnerability

Vulnerable Android dialers can enable one-click MMI execution

karansaini.com 14 min read Editor score 7/10

The reported flaws let an attacker trigger MMI codes through a vulnerable dialer with little or no user interaction. The issue illustrates how app permissions and dialer handling can expose sensitive phone functions.

What

- Vulnerable Android dialer apps can enable one-click execution of MMI/USSD codes through apps holding `CALL_PHONE`.

How

- These codes can configure carrier services; the permission dialog omits this capability, and execution occurs without a prompt at that moment.

Why it matters

- Permission reviews must account for carrier-control commands, not just ordinary calls, because codes can change call-forwarding settings.

Read on karansaini.com → Lobsters

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.