{"id":"CVE-2024-43093","kind":"vulnerability","aliases":["CVE-2024-43093"],"related":[],"title":"google android: In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to…","description":"In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to  incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","summary":"Android Framework has an unspecified flaw that lets a local app gain higher privileges on the device. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.3,"epss":null,"exploited":true,"exploited_at":"2024-11-07T00:00:00+00:00","products":[{"name":"Android Framework","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 12.1","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 14.0","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 15.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","mobile","runtime"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Android security patch that addresses CVE-2024-43093 per vendor instructions; the sources do not name the patch level.","status":"open","published_at":"2024-11-07T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:18+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T20:56:18Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Android security patch that addresses CVE-2024-43093 per vendor instructions; the sources do not name the patch level.","reach":"local","impact":"high","summary":"Android Framework has an unspecified flaw that lets a local app gain higher privileges on the device. CISA lists it as actively exploited in the wild.","category":"runtime","who_cares":["android","mobile"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker escalates privileges on the Android device, possibly to system level.","analyst_note":"Find the Android security bulletin entry for CVE-2024-43093 to get affected versions, patch level and any mitigation; the KEV entry does not say.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000436,"input_tokens":2778,"output_tokens":316,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':19A,22A '-43093':20A,23A 'access':83C 'activ':61B 'addit':102C 'android':2A,24A,27A,29A,31A,33A,35A,36B,40B 'app':50B 'bypass':11A,74C 'cisa':57B 'could':93C 'cve':18A,21A 'design':17A,80C 'devic':56B 'directori':86C 'due':87C 'escal':97C 'execut':103C 'exploit':37B,62B,111C 'externalstorageprovider.java':6A,69C 'file':14A,77C 'filter':16A,79C 'flaw':45B 'framework':25A,41B 'gain':51B 'googl':1A 'google':26A,28A,30A,32A,34A 'higher':52B 'incorrect':89C 'interact':107C 'lead':94C 'let':47B 'list':58B 'local':49B,96C 'mobil':38B 'need':105C,109C 'normal':91C 'path':15A,78C 'possibl':10A,73C 'prevent':82C 'privileg':53B,99C,104C 'runtim':39B 'sensit':85C 'shouldhidedocu':4A,67C 'unicod':90C 'unspecifi':44B 'user':106C 'wild':65B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-07T00:00:00+00:00","kev":{"dateAdded":"2024-11-07","dueDate":"2024-11-28","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-43093","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43093","severity":null,"published_at":"2024-11-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-43093","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43093","severity":null,"published_at":"2024-11-13T18:15:21+00:00","modified_at":"2026-06-17T07:50:25+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}