CVE-2023-21246

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-754CWE-273

Affected software

No affected versions have been published.

Timeline

Published
Jul 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212477.8In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restrictCVE-2023-212487.8In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction dCVE-2023-212495.5In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a permissions bypass. TCVE-2023-212509.8In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote codCVE-2023-212517.3In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. ThisCVE-2023-212525.5In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validatiCVE-2023-212535.5In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denialCVE-2023-212547.8In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed CVE-2023-212557.8In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of priCVE-2023-212567.8In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. ThisCVE-2023-212577.8In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing peCVE-2023-212605.5In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user p
CVE-2023-21246: Low severity, CVSS 3.3 | Vulnix