Live › vulnerability › CVE-2023-35674
Go to dashboardAndroid Framework contains an unspecified flaw that lets a local app gain higher privileges on the device. An attacker who gets a malicious app onto a phone can escalate to system-level control, and CISA lists it as exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Android Framework | vendor | – | – |
| google android | vendor | = 11.0 | – |
| google android | vendor | = 12.0 | – |
| google android | vendor | = 12.1 | – |
| google android | vendor | = 13.0 | – |
Check the Android security bulletin for the device's patch level (Settings > About phone > Android security update) against the July 2023 bulletin.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2023-35674")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.