CVE-2023-35674
Android Framework Privilege Escalation Vulnerability
Description
CVE-2023-35674 is a privilege escalation vulnerability in the Android Framework, specifically in the onCreate method of WindowState.java. A logic error in the code allows a background activity to be launched without proper authorization, enabling local escalation of privilege without requiring any additional execution privileges or user interaction. This Android Framework vulnerability was addressed in the September 2023 Android Security Bulletin and has been added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Although the EPSS score of 0.087% suggests limited exploitation probability, the confirmed active exploitation makes CVE-2023-35674 a priority for Android device administrators.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 11.0; 12.0; 12.1; 13.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e(Patch)
- https://source.android.com/security/bulletin/2023-09-01(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35674(Third Party Advisory, US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
The Android Framework vulnerability involves improper privilege management where a logic error in WindowState.java allows a background activity to be launched with elevated privileges. In the context of CVE-2023-35674, this weakness manifests as the Android system failing to properly enforce privilege boundaries during activity creation, enabling an application to escalate its privileges beyond its intended scope.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2023-35674 carries a CVSS v3.1 score of 7.8 (High), reflecting significant local impact. The vulnerability requires local access — an attacker must have the ability to execute code on the Android device, such as through a malicious application — but the attack complexity is low with no special conditions needed. Privileges Required (Low): The attacker needs only basic application-level privileges, such as those available to a standard installed app. User Interaction (None): No user action is required to trigger the exploit, making it particularly dangerous for automated or silent exploitation. Confidentiality (High): An attacker who escalates privileges can access protected user data including contacts, messages, photos, and credentials stored on the device. Integrity (High): Elevated privileges allow modification of system settings, installation of additional malicious components, and tampering with other applications' data. Availability (High): The attacker can disrupt device operations or render the device unusable. While the EPSS score of 0.087% suggests limited widespread exploitation, CISA's confirmation of active exploitation indicates targeted attacks are occurring against Android users.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-35674 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 4, 2023. No public exploit code or proof-of-concept has been identified in the available references; the exploit appears to be used in targeted attacks rather than through widely available tools. The EPSS score of 0.087% indicates exploitation is not yet widespread, and the ransomware usage status is listed as Unknown. A patch is available from Google, addressing the logic error in the Android Framework.
Remediation
- Apply mitigations per vendor instructions as directed by CISA (remediation deadline: October 4, 2023). Install the September 2023 Android Security Bulletin update, which includes the patch for CVE-2023-35674 addressing the logic error in WindowState.java.
- Update Android devices to the latest security patch level (September 2023 or later). For device manufacturers and carriers, prioritize distribution of the security update to affected device models. For enterprise environments, enforce minimum security patch levels through mobile device management (MDM) policies.
- Restrict application installations to trusted sources only (Google Play Store) and enable Google Play Protect to scan for potentially harmful applications that may attempt to exploit this privilege escalation vulnerability. Review installed applications for unnecessary permissions.
- Monitor device behavior for indicators of compromise, including unexpected background activity launches, unusual permission requests, and unexplained changes to system settings. Deploy mobile threat detection solutions to identify exploitation attempts in enterprise environments.
- Implement defense-in-depth by ensuring devices use full-disk encryption, enforcing lock screen policies, and applying the principle of least privilege for application permissions. For enterprise deployments, consider network-level protections that can detect anomalous communication from compromised devices.
Technical Details
CVE-2023-35674 is a privilege escalation vulnerability (CWE-269, Improper Privilege Management) in the Android Framework's WindowState.java component. The vulnerability exists in the onCreate method, where a logic error fails to properly validate whether an activity should be permitted to launch from a background context. Under normal operation, Android restricts background activity starts to prevent malicious applications from hijacking the user interface or performing unauthorized actions. However, this logic flaw allows an attacker to bypass these restrictions and launch a background activity that operates with elevated privileges, without requiring additional execution privileges beyond those of a standard application. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is local with low complexity, requires only low privileges, needs no user interaction, and achieves full compromise of the device's confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2023-35674 being actively exploited?
Yes, CVE-2023-35674 is actively exploited. CISA has confirmed its inclusion in the Known Exploited Vulnerabilities catalog, indicating exploitation in the wild. While the EPSS score of 0.087% suggests limited widespread activity, the confirmed exploitation means Android users and administrators should prioritize patching.
What products are affected by CVE-2023-35674?
CVE-2023-35674 affects Google Android devices through a vulnerability in the Android Framework's WindowState.java component. All Android devices that have not applied the September 2023 security patch level (or later) are potentially vulnerable. The vulnerability is platform-wide and not limited to specific device manufacturers.
How do I fix CVE-2023-35674?
Apply the September 2023 Android Security Bulletin update, which patches CVE-2023-35674. Update your Android device to the latest available security patch level through your device's system settings. Enterprise administrators should enforce minimum patch levels through MDM policies and restrict app installations to trusted sources.
How severe is CVE-2023-35674?
CVE-2023-35674 is rated High with a CVSS v3.1 score of 7.8 out of 10. It enables local privilege escalation without user interaction, making it particularly dangerous for automated exploitation. While it is in the 25th percentile for exploitation probability based on EPSS, CISA's confirmation of active exploitation makes it a priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.