CVE-2023-35674

Android Framework Privilege Escalation Vulnerability

Android

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

11. Sep 2023

Ausgewertete Quellen

• Android
  https://source.android.com/security/bulletin/2023-09-01
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35674
• CISA
  Android Framework Privilege Escalation Vulnerability
• NVD
  CVE-2023-35674