CVE-2023-21286

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.19% chance of exploitation in the next 30 days, 9th percentile

Published

2023-08-14

Updated

2024-10-09

Proof-of-concept exploits (1)

• Trinadh465/platform_frameworks_base_CVE-2023-212860★ · 2023-10-03

References

• CVE Record
• NVD entry

Related

• CVE-2023-21284
• CVE-2023-21288
• CVE-2023-21282
• CVE-2023-2130
• CVE-2023-21281
• CVE-2023-2143