CVE-2023-35682: High severity Google Android vulnerability

Published Sep 5, 2023

Updated

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-35682.

What is the severity of CVE-2023-35682?

The severity of CVE-2023-35682 is high with a severity value of 7.

What is the affected software for CVE-2023-35682?

The affected software for CVE-2023-35682 is Google Android versions 11.0, 12.0, 12.1, and 13.0.

What is the description of CVE-2023-35682?

CVE-2023-35682 is a vulnerability in PackageManagerHelper.java that may allow starting arbitrary components and lead to local escalation of privilege with no additional execution privileges needed, requiring user interaction for exploitation.

How can I fix CVE-2023-35682?

To fix CVE-2023-35682, it is recommended to apply the security patch provided by Google for the affected Android versions.