CVE-2023-45777

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Google	Android	14; 13

References

https://android.googlesource.com/platform/frameworks/base/+/f4644b55d36a549710ba35b6fb797ba744807da6Mailing List, Patch
https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6Mailing List, Patch
https://source.android.com/security/bulletin/2023-12-01Patch, Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/f4644b55d36a549710ba35b6fb797ba744807da6Mailing List, Patch
https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6Mailing List, Patch
https://source.android.com/security/bulletin/2023-12-01Patch, Vendor Advisory

Timeline

Published: Dec 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-457797.8In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could CVE-2023-45786.5When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path i CVE-2023-457807.3In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of pr CVE-2023-457815.5In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information di CVE-2023-45793.1Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well form CVE-2023-457935.5A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the CVE-2023-457948.1A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All CVE-2023-457957.8A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to injec CVE-2023-457968.1A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.3399 CVE-2023-457979.8A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.CVE-2023-457989.8In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malici CVE-2023-457999.8In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attack