Unscored CVE-2023-40123 EUVD-2023-44730GHSA-h7m2-v987-3v73

In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could…

Published Oct 27, 2023 · Updated Sep 9, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-2548 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023
WID-SEC-2023-2539 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/7212a4bec2d2f1a74fa54a12a04255d6a183baa9
https://source.android.com/security/bulletin/2023-10-01