Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-21029: Google Android framework can expose which apps are used

CVE-2023-21029 · published 3 years ago

Summary

The core Android system software from Google may let anyone with access to a device see a list of the apps that have been running. This could reveal business activities or employee habits without the user knowing. Install the latest Android updates as soon as they are released and limit physical or remote access to company devices.

What to do

Update google platform/frameworks/base to version 13:2023-03-01.

Affected software

Ecosystem	Vendor	Product	Affected versions
Android	google	platform/frameworks/base	>= 13:0, < 13:2023-03-01 Fix: upgrade to 13:2023-03-01
–	google	android	13.0 `cpe:2.3:o:google:android:13.0:::::::*`

Original advisory text

In register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usage with User execution privileges needed. User interaction ...

References

https://source.android.com/security/bulletin/pixel/2023-03-01 Patch Vendor Advisory
https://source.android.com/security/bulletin/2023-03-01 Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/4a06c40b87e953a39e3f... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published1 Mar 2023

Updated30 Sep 2026

First seen11 Mar 2026

Sources

CVE-2023-21029 · OSV

CVE-2023-21029 · NVD

PUB-A-217934898 · OSV

Track software like this

Free during beta