CVE-2023-21237
Android Pixel Information Disclosure Vulnerability
Description
CVE-2023-21237 is a medium-severity information disclosure vulnerability affecting Android 13, specifically the Google Pixel product line. The flaw exists in the applyRemoteView function of NotificationContentInflater.java and allows a malicious application to hide foreground service notifications from the user, exploiting misleading or insufficient UI rendering. By concealing these system notifications, a locally-installed malicious app can prevent users from knowing that a background service is running, facilitating unauthorized data collection or other covert activity without the user's awareness. Exploitation requires low privileges and no user interaction. CISA has listed CVE-2023-21237 in its Known Exploited Vulnerabilities catalog, indicating confirmed real-world exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 13.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://source.android.com/security/bulletin/pixel/2023-06-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21237(Third Party Advisory, US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where a product exposes sensitive information to an actor who is not explicitly authorized to have access to it. In CVE-2023-21237, the insufficient or misleading notification UI allows a malicious app to hide a foreground service notification, thereby denying the user visibility into the app's background activity — an indirect form of information disclosure where the system fails to present security-relevant state information to the user.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2023-21237 is rated MEDIUM with a CVSS 3.1 score of 5.5. Confidentiality is the sole impacted security property, rated HIGH: the vulnerability enables local information disclosure by allowing an attacker to conceal the presence of a running foreground service. In Android's security model, foreground services are required to display persistent notifications to inform users that the app is actively running in the background. When this notification can be suppressed or made invisible, users lose the ability to detect that an app is actively operating — which could mask activities such as location tracking, microphone access, or data exfiltration.
Integrity and Availability are not impacted by this vulnerability, reflecting its nature as a UI deception flaw rather than a direct system compromise. The attack vector is local, meaning a malicious app must already be installed on the device, and exploitation requires only low privileges with no user interaction needed. The practical impact depends on what the concealed service does: in a targeted attack scenario, a malicious app that abuses CVE-2023-21237 to hide its foreground service notification could conduct sustained covert surveillance — accessing the microphone, camera, contacts, or location — without the user ever seeing the expected notification banner that would normally alert them to the activity.
Exploit Maturity
CVE-2023-21237 has been included in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 26, 2024, indicating that CISA has evidence of active exploitation in the wild. The vulnerability was originally disclosed in Google's June 2023 Pixel Security Bulletin. The EPSS score is 0.00703 (approximately 72nd percentile), which is meaningfully higher than the CWE-200 average, suggesting a non-trivial real-world exploitation likelihood.
The nature of the vulnerability — enabling concealment of background app activity — makes it particularly suitable for use in stalkerware or spyware applications targeting individuals. Unlike network-accessible vulnerabilities, this flaw requires a malicious app to be installed on the target device first, limiting mass exploitation but making it valuable in targeted attack scenarios. The combination of CISA KEV listing and EPSS percentile above the 70th mark suggests the vulnerability has been incorporated into actual malicious tools, consistent with mobile surveillance use cases.
Remediation
- Apply Android and Pixel security updates: Install the June 2023 Pixel Security Update or later Android security patches that address CVE-2023-21237. Apply updates via Settings > System > System Update.
- Enable automatic security updates: Configure Android devices to automatically download and apply security patches to minimize exposure windows.
- Review installed applications: Audit apps installed on Android devices, particularly those with notification or background execution permissions. Remove any untrusted or unfamiliar applications.
- Review app permissions: Check which apps have been granted sensitive permissions (location, microphone, camera, contacts) via Settings > Privacy > Permission Manager and revoke permissions from untrusted apps.
- Monitor running services: Use Android's battery usage, data usage, and permission monitoring tools to identify apps running unexpected background services.
- Follow CISA KEV guidance: Federal agencies and organizations subject to CISA directives should apply mitigations by the March 26, 2024 deadline per the KEV catalog entry.
- Enforce mobile device management (MDM) policies: Organizations managing Android devices should use MDM to enforce patch compliance and restrict installation of unverified applications.
- Educate users about app sources: Limit app installations to the Google Play Store and educate users about the risks of sideloading applications from unknown sources.
Technical Details
CVE-2023-21237 is a UI deception vulnerability in Android 13, specifically in the applyRemoteView method of NotificationContentInflater.java. This code is responsible for inflating and rendering notification views for foreground services — background application components that Android requires to display persistent status bar notifications to maintain user transparency.
Root cause: The vulnerability involves misleading or insufficient UI handling, classified as CWE-200 (Exposure of Sensitive Information). A malicious application can craft a remote view or notification content that, when processed by applyRemoteView, results in a notification being hidden, collapsed, or rendered in a way that makes it invisible or imperceptible to the user. This defeats the purpose of Android's foreground service notification requirement, which exists specifically to inform users that an app is actively running in the background.
Android security model context: Android mandates that apps running foreground services must maintain a visible notification. This mechanism is a core user transparency feature: without it, apps could run indefinitely in the background without user awareness, consuming resources and potentially accessing sensitive hardware (microphone, camera, GPS) covertly. CVE-2023-21237 undermines this control by allowing the notification to be effectively hidden through a malformed or deceptive notification view.
CVSS context: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a local attack with low complexity, low privilege requirement, no user interaction, and impact solely on confidentiality. The vulnerability was identified by Android ID A-251586912 and addressed in the June 2023 Pixel Security Bulletin.
Frequently Asked Questions
What does CVE-2023-21237 actually allow an attacker to do?
CVE-2023-21237 allows a malicious app installed on an Android 13 device to hide the persistent notification that is normally required to be displayed when a foreground service is running. By suppressing this notification, the malicious app can operate in the background — potentially accessing the microphone, camera, location, or other sensitive resources — without the user being aware that the app is active. This makes it a tool for covert surveillance or stalkerware.
Which Android versions and devices are affected by CVE-2023-21237?
CVE-2023-21237 affects Android 13, and the KEV catalog specifically identifies the Google Pixel product line. The vulnerability was addressed in Google's June 2023 Pixel Security Bulletin. Users of other Android 13 devices should check with their device manufacturer for the applicable security patch.
Is CVE-2023-21237 dangerous even though it is rated MEDIUM?
The MEDIUM CVSS rating (5.5) reflects that exploitation requires a locally-installed app and only impacts confidentiality indirectly. However, CISA's KEV listing confirms active real-world exploitation, meaning actual attackers have weaponized this flaw. In targeted attack scenarios — particularly stalkerware or spyware against specific individuals — the ability to hide a foreground service is highly valuable, making the practical risk greater than the CVSS score alone suggests.
How can I tell if an app is hiding a foreground service using this vulnerability?
On a patched Android device, foreground service notifications are always visible. On a vulnerable unpatched device, there may be no visible indication of a running foreground service if the exploit is active. You can check for running services indirectly through Settings > Battery > Battery Usage (look for apps consuming unusual battery in the background), Settings > Privacy > Permission Manager (check which apps have sensitive permissions), and Settings > Apps > See All Apps > Running Services. The best protection is to apply the June 2023 or later security patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.