Skip to content
OpenAdvisories
High · 7.8 CVE-2023-21099 EUVD-2023-25267GHSA-6mmp-j4hv-4xjc

In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logi…

Published Apr 19, 2023 · Updated Feb 5, 2025 · Assigned by google_android

Platform: Android

Description

In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-243377226

Affected products

VendorProductAffectedFixed
— Android Android-11 Android-12 Android-12L Android-13 —

Advisories 2

References