CVE-2023-35674

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Sep 13, 2023
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-356755.5In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user oCVE-2023-356767.8In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafCVE-2023-356775.5In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could leaCVE-2023-356795.5In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local informationCVE-2023-35684.8Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-356805.5In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to locaCVE-2023-356819.8In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remoCVE-2023-356827.8In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. ThCVE-2023-356835.5In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could leaCVE-2023-356848.8In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalCVE-2023-356857.8In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to localCVE-2023-356867.8In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local
CVE-2023-35674: High severity, CVSS 7.8 | Vulnix