VDB
ASB-A-197296414
ASB-A-197296414
PUBLISHED
In several functions of inputDispatcher.cpp, there is a possible way to make toasts clickable due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| platform | frameworks/native | 12, 13-next:0, 11:0 |
| platform | frameworks/base | 13-next, 11:0, 11 |
Timeline
- May 1, 2023 CVE Published
- May 15, 2026 CVE Updated
References
- https://source.android.com/security/bulletin/2023-05-01 advisory
- https://android.googlesource.com/platform/frameworks/native/+/062a867e94dbf811ccca02e7a6a0f0e36465694a patch
- https://android.googlesource.com/platform/frameworks/native/+/9cf4a4d4e57d059a4e4119f0a8f2a8be237f28c2 patch
- https://android.googlesource.com/platform/frameworks/base/+/3b8aa02ba51f26161519f6465515f619e663bbbf patch
- https://android.googlesource.com/platform/frameworks/base/+/d100067fd62adb4648e966b3306b9a2f3b1fd38e patch
- https://android.googlesource.com/platform/frameworks/native/+/a066d908f6fe28e63ae49327b57fcd31d63fba2d patch