High · 7.8 CVE-2023-40111 EUVD-2023-44718GHSA-3rhh-97v9-2g42

In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a …

Published Feb 15, 2024 · Updated Mar 28, 2025 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	14	—

Advisories 2

WID-SEC-2023-2841 Samsung Android: Mehrere Schwachstellen ermöglichen BSI CERT-Bund (WID) · Dec 5, 2023
WID-SEC-2023-2842 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/55d3d57cbffc838c52d610af14a056dea87b422e
https://source.android.com/security/bulletin/2023-11-01