CVE-2022-20446

What it actually does

Missing permission check in AlwaysOnHotwordDetector allows an installed app to access the microphone while running in the background without the RECORD_AUDIO permission.

Why it matters to the business

Organizations using affected Android devices face elevated risk of unauthorized audio capture on employee or managed endpoints, potentially exposing sensitive conversations and increasing compliance exposure until devices are updated.

How an attack unfolds

A malicious app installed on the device invokes the AlwaysOnHotwordDetector service without holding the required permission; because the check is absent, the framework grants microphone access from the background, enabling silent audio recording with no user interaction required.

How to fix it

Upgrade affected Android devices to a patched release that enforces the missing permission check; apply vendor security updates as soon as they become available for Android 10 and 11 builds.

How to confirm the fix worked

Confirm the device is running a patched build by checking the security patch level string and verify that attempts to start AlwaysOnHotwordDetector without RECORD_AUDIO now correctly fail with a security exception.

Typical attack path

1. Attacker develops or repackages an Android application targeting API levels corresponding to Android 10 or 11
2. App is installed on the target device through any available distribution channel
3. At runtime the app calls the vulnerable AlwaysOnHotwordDetector code path
4. Framework grants microphone access due to absent permission enforcement
5. Audio stream is captured and exfiltrated without user notification

How to detect it

Monitor Android system logs and audit logs for permission-check bypass indicators around hotword or audio services; look for processes invoking AlwaysOnHotwordDetector without corresponding permission grants in PackageManager logs.

What your security team should do

• Prioritize deployment of the next available Android security update to all managed devices running versions 10 or 11
• Review enterprise mobile-application whitelists to reduce exposure from sideloaded or unvetted apps
• Enable Android Enterprise work-profile restrictions where possible to limit background sensor access