GSD-2023-21285 — Vulnetix

GSD-2023-21285 PUBLISHED

In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Products

Vendor	Product	Versions
Google	Android	13, 12L, 12

Timeline

Nov 28, 2020 CVE Published

References

https://android.googlesource.com/platform/frameworks/base/+/0c3b7ec3377e7fb645ec366be3be96bb1a252ca1 url
https://source.android.com/security/bulletin/2023-08-01 url

Open in Interactive Console →