CVE-2023-21237 Android Pixel Information Disclosure Vulnerability
A local attacker can hide foreground service notifications in Android, leading to information disclosure without user interaction or elevated privileges.
- Exploited in the wild
- Since 5 Mar 2024
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-21237?
CVE-2023-21237 is a medium-severity vulnerability in Google Android, published on 28 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
Weakness: CWE-200
Which versions are affected by CVE-2023-21237?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2023-21237?
Apply the vendor's patch. US federal agencies must fix it by 26 Mar 2024.
Is CVE-2023-21237 being exploited?
Yes. Attackers have exploited CVE-2023-21237 in the wild since at least 5 Mar 2024.
Other vulnerabilities in Google Android
Sources
Also known as A-251586912, GHSA-qhm9-gg74-g6m6, PUB-A-251586912.