ASB-A-283006437 — Vulnetix

ASB-A-283006437 PUBLISHED

In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Affected Products

Vendor	Product	Versions
platform	frameworks/base	13, 13-next, *
platform	packages/apps/Launcher3	13-next, 13, 13-next:0

Timeline

Aug 1, 2023 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2023-08-01 advisory
https://android.googlesource.com/platform/frameworks/base/+/e7ccba6da2c3febeb449c172c1d8091f7a35193d patch

Open in Interactive Console →