CVE-2023-35674highunder attackCWE-269

CVE-2023-35674: high-severity vulnerability in Google Android

Published · Updated

Follow this CVE+ Monitor Android

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 2.6%
from disclosure to weaponsame day
Published on NVDSep 11
1st PoCSep 11
CISA KEV+2d
Action required by CISAfederal deadline: 2023-10-04

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Android's WindowState allows an app to launch background activities without proper restrictions, potentially letting it gain unauthorized privileges on the device. This happens due to a logic error and doesn't require user interaction.

Technical detail

A logic error in WindowState.java onCreate method permits launching of background activities without enforcing intended restrictions, enabling local privilege escalation. The vulnerability requires no additional execution privileges and is exploitable without user interaction, presenting a direct path to unauthorized capability elevation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Google · Android
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Google Android

In the same product, most dangerous first.

CVE-2024-32896HIGHCVE-2024-32896EPSS 3.0%KEVCVE-2025-48595HIGHCVE-2025-48595EPSS 1.9%KEVCVE-2024-43093HIGHCVE-2024-43093EPSS 0.7%KEVCVE-2024-29748HIGHCVE-2024-29748EPSS 0.7%KEVCVE-2025-48543HIGHCVE-2025-48543EPSS 0.7%KEVCVE-2026-58704HIGHCVE-2026-58704EPSS 0.6%KEV