1-click MMI/USSD execution in Android via CALL_PHONE and browser-reachable dialer deeplinks (ACR Phone / com.nll.cb)

Summary by Cyber Security News15 Oct 2026, 09:41 CET

About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Oct/10

Posted by Karan Saini on Oct 15 Android's CALL_PHONE permission, shown to users as "make and manage phone calls", also authorises execution of carrier MMI/USSD codes against the SIM. The permission text does not mention this, no confirmation is shown before execution -- a transient "USSD code running" dialog appears only afterwards

Read the full article at Full Disclosure →

Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

🏴☠️ Aurora has just published a new victim : Meleghy Automotive & Cie. GmbH

Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps

Chrome for Android Update

Beta Channel Update for ChromeOS / ChromeOS Flex

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens