Unscored CVE-2023-45774 EUVD-2023-50063GHSA-jqjg-g4gc-qvcw

In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This c…

Published Dec 4, 2023 · Updated Dec 2, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	14, 13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-3057 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 6, 2023
WID-SEC-2023-3056 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 4, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/f229f0e55b07416badaca0e3493db5af0943c9eb
https://source.android.com/security/bulletin/2023-12-01