GSD-2023-21277 — Vulnetix

GSD-2023-21277 PUBLISHED

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

Affected Products

Vendor	Product	Versions
Google	Android	12, 13, 12L

Timeline

Nov 28, 2020 CVE Published

References

https://android.googlesource.com/platform/frameworks/base/+/9b58aee2a4528c60b0aa2540bd0f48d2871d2dc7 url
https://source.android.com/security/bulletin/2023-08-01 url

Open in Interactive Console →