Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android framework lets background apps launch without check

CVE-2023-20916 · published 3 years ago
Summary

The core Android system code (frameworks/base) fails to verify a permission when launching the main activity of an app. This omission can let a malicious app start another app’s interface while running in the background, potentially gaining higher privileges without user interaction. Apply the latest system updates from Google that include the permission check fix.

What to do
  • Update google platform/frameworks/base to version 12:2023-01-01.
  • Update google platform/frameworks/base to version 12L:2023-01-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 12:0, < 12:2023-01-01
>= 12L:0, < 12L:2023-01-01
Fix: upgrade to 12:2023-01-01
– google android 12.0
12.1
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Original advisory text
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This cou...
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published1 Jan 2023
Updated26 Oct 2026
First seen17 Aug 2026
Sources
ASB-A-229256049 · OSV
CVE-2023-20916 · NVD
Track software like this
Free during beta