CVE-2023-21237KEV · OVERDUE

Android Pixel Information Disclosure Vulnerability

Medium · published June 28, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.2. It is confirmed in active exploitation. It sits in the 17.5th percentile for exploit probability.

942
days past CISA
deadline
CVSS v3.1
6.2
EPSS
0%
Percentile
17.5
In the wild
Confirmed
What it is

⚠️ A hidden notification could let local snoopers peek at sensitive info without breaking a sweat! Think of it like a restaurant where the waiter forgets to deliver your bill to the table, leaving your private dining experience unmonitored and open to prying eyes. This vulnerability in Android can let anyone spot what they shouldn’t see, all because notifications aren’t as visible as they should be. If exploited, an attacker could easily reveal personal data through notifications that should have remained private, leading to potentially embarrassing or sensitive information being exposed. This is a medium-severity issue but still poses a notable risk, especially in shared spaces or devices!

Put simply

Think of it like a restaurant where the waiter forgets to deliver your bill to the table, leaving your private dining experience unmonitored and open to prying eyes. This vulnerability in Android can let anyone spot what they shouldn’t see, all because notifications aren’t as visible as they should be. This vulnerability arises in the `applyRemoteView` method of `NotificationContentInflater.java`, which fails to adequately display foreground service notifications, allowing unauthorized access to potentially sensitive information without needing any additional privileges.

What to do

If exploited, an attacker could easily reveal personal data through notifications that should have remained private, leading to potentially embarrassing or sensitive information being exposed. This is a medium-severity issue but still poses a notable risk, especially in shared spaces or devices! To mitigate this, ensure your Android device is updated to the latest version where this issue has been addressed. Developers should also review notifications logic to ensure privacy is prioritized and consider implementing UI checks to prevent information leakage. You've got this! Follow these steps to secure your device and keep your notifications safely under wraps! 🛡️

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Published
2023-06-28T00:00Z
KEV added
2024-03-05 · due 2024-03-26
EPSS history
Timeline
  • 05 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 26
    kev
  • 28 JUN 00:00Z
    In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI
    cvelistv5