CVE-2023-21089

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237766679

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-21096.1Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.CVE-2023-210905.0In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. This could lead to local deniaCVE-2023-210915.5In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission checkCVE-2023-210927.8In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of SyCVE-2023-210937.8In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a paCVE-2023-210947.8In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permissCVE-2023-210954.7In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a race condition. This coCVE-2023-210969.8In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional exeCVE-2023-210977.8In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local escCVE-2023-210987.8In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a conCVE-2023-210997.8In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logicCVE-2023-21107.1Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfil
CVE-2023-21089: High severity, CVSS 7.8 | Vulnix