Medium · 5.5 CVE-2024-0020 EUVD-2024-15823GHSA-4ghg-fwhw-h8j9

In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a…

Published Feb 16, 2024 · Updated Mar 19, 2025 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. This could lead to local information disclosure across users of a device with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	14, 13, 12L, 12, 11	—

Advisories 1

WID-SEC-2024-0009 Google Android und Pixel Patchday Januar 2024 BSI CERT-Bund (WID) · Jun 4, 2024

References

https://android.googlesource.com/platform/packages/apps/Settings/+/87f791f2351e366f842a0fd6fcb744069160d9a1
https://source.android.com/security/bulletin/2024-01-01