LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33057: The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.pe...

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

QQ 8.7.1 for Android and iOS may allow a mini-program to determine a user's physical location even when normal location permission requirements are not enforced. This is primarily a mobile privacy and sensitive-location exposure risk, not a server compromise finding.

Executive priority

Treat this as a targeted mobile privacy review, not an emergency breach indicator. Prioritize faster if executives, travelers, regulated teams, or sensitive-location personnel use QQ on work-managed devices.

Technical view

The CVE describes a permission-enforcement flaw in QQ 8.7.1 mobile app map functionality. A mini-program context could expose latitude and longitude without the expected platform location permission gate. The source bundle provides no CVSS score, CWE, confirmed fixed version, or complete affected-product metadata.

Likely exposure

Exposure is most likely on managed or employee-owned Android and iOS devices running QQ 8.7.1, especially where QQ mini-programs are permitted. The bundle does not confirm whether later QQ versions are affected.

Exploitation context

The CVE is not listed as KEV, and the provided sources do not claim active exploitation. The public description explains an API-abuse path, but evidence is limited to the cited reports and CVE metadata.

Researcher notes

The CVE record has sparse metadata: no CVSS, CWE, CPE, or fixed version in the bundle. The description specifically names QQ 8.7.1 on Android and iOS and a location permission bypass in mini-program map behavior.

Mitigation direction

  • Inventory Android and iOS devices for QQ 8.7.1 installations.
  • Check Tencent guidance for fixed versions or official mitigation advice.
  • Update QQ where a vendor-supported fixed version is available.
  • Restrict QQ use on sensitive managed devices if no fix is confirmed.
  • Use MDM controls to limit location access and unapproved applets where possible.

Validation and detection

  • Confirm whether QQ 8.7.1 is present in mobile asset inventories.
  • Review MDM reports for QQ versions across Android and iOS fleets.
  • Verify whether business workflows require QQ mini-program access.
  • Check vendor sources for patch or version guidance before closure.
  • Document residual risk if users must keep QQ installed.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-33057 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.