CVE-2023-35674

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  • Published Sep 11, 2023
  • CVSS 7.8 high
  • 2.6% chance of exploitation in the next 30 days (EPSS)
  • In CISA's Known Exploited Vulnerabilities catalog
  • A fix is available

Affected software

CVE-2023-35674 at the National Vulnerability Database