Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android screensaver may reveal hidden messages

CVE-2024-34741 · published 2 years ago
Summary

The core Android system code can accidentally display message content on the lock‑screen screensaver even when the user has set it to stay hidden. This could let someone nearby see private information without needing any special access or interaction. Update the Android system to the latest version or apply the vendor’s security patch to fix the logic error.

What to do
  • Update google platform/frameworks/base to version 14-next:2024-08-01.
  • Update google platform/frameworks/base to version 12:2024-08-01.
  • Update google platform/frameworks/base to version 12L:2024-08-01.
  • Update google platform/frameworks/base to version 13:2024-08-01.
  • Update google platform/frameworks/base to version 14:2024-08-01.
Affected software
Ecosystem VendorProductAffected versions
– google android 12.0
12.1
13.0
14.0
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Android google platform/frameworks/base >= 14-next:0, < 14-next:2024-08-01
>= 12:0, < 12:2024-08-01
>= 12L:0, < 12L:2024-08-01
>= 13:0, < 13:2024-08-01
>= 14:0, < 14:2024-08-01
Fix: upgrade to 14-next:2024-08-01
Original advisory text
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted ...
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted by the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
CWE-783Operator Precedence Logic Error
Timeline
Published1 Aug 2024
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-34741 · NVD
ASB-A-318683640 · OSV
Track software like this
Free during beta