IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
6.2Medium KEV

CVE-2023-21237Android Pixel Information Disclosure Vulnerability

Android; google android Published: (3 years ago)

Known exploited — Android Pixel Information Disclosure Vulnerability

CISA confirmed this vulnerability is used in real attacks on 05.03.2024. Remediation deadline for US federal agencies: 26.03.2024.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://source.android.com/docs/security/bulletin/pixel/2023-06-01; https://nvd.nist.gov/vuln/detail/CVE-2023-21237

Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

Weakness (CWE): CWE-200

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
google android 13.0
— Android Android-13

References and patches

CPE matches (NVD) (1)
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

Recent CVEs in the same product — Android

6.7Medium
CVE-2026-58977
Google Android

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Unscored
CVE-2026-58930
Google Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, injec…

Unscored
CVE-2026-58927
Google Android

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a …

Unscored
CVE-2026-58926
Google Android

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacke…

Unscored
CVE-2026-58925
Google Android

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigg…

Unscored
CVE-2026-58924
Google Android

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within th…