ASB-A-258672042 — Vulnetix

ASB-A-258672042 PUBLISHED CVSS 8.600000381469727 HIGH

In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS 4.0

8.600000381469727

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
platform	frameworks/base	12:0, 12, 12L
platform	frameworks/av	12:0, 12, 12L:0

Timeline

Feb 1, 2023 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2023-02-01 advisory
https://android.googlesource.com/platform/frameworks/av/+/078b6a44e4bcd8e91a9935d93e25166e27552c74 patch
https://android.googlesource.com/platform/frameworks/base/+/7fa5e42281f9ceb827b594cfee598a1814ac2c50 patch

Open in Interactive Console →