CVE-2024-43093: high-severity vulnerability in Google Android
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A file access control in Android's external storage provider can be bypassed using special unicode characters, allowing an attacker to access files they shouldn't be able to reach. An attacker needs to trick a user into interacting with a malicious file or app to exploit this.
CVE-2024-43093 exploits improper unicode normalization in ExternalStorageProvider's shouldHideDocument method (CWE-176), allowing a local attacker to circumvent path-based filtering of sensitive directories. The attack requires user interaction but no elevated privileges, resulting in unauthorized file access and potential privilege escalation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.