Android Pixel Information Disclosure Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-03-05

[ Description ]Official description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

CISA: Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 26 Mar 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• source.android.com/security/bulletin/pixel/2023-06-01Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource