CVE-2018-9567
The most severe vulnerability in this section could enable a local attacker to bypass user interaction requirements in order to gain access to additional permissions.
https://source.android.com/security/bulletin/2018-12-01
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9567