6.2 Medium Exploited

CVE-2023-21237 Android Pixel Information Disclosure Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-200

Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

Affected products and versions

Product	Affected versions	Fixed in
Android	Versions not published
Android	13.0	No fix stated

References

source.android.com source.android.com

Timeline

Published June 28, 2023
Added to the KEV catalogue March 5, 2024
Last modified October 21, 2025

The 2441 CVEs of Android →

CVE-2023-21149 In registerGsmaServiceIntentReceiver of ShannonRcsService.java, there is a possible way to activate/deactivate RCS… Not rated CVE-2023-21205 In startWpsPinDisplayInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization Not rated CVE-2023-21157 In encode of wlandata.cpp, there is a possible out of bounds write due to a heap buffer overflow Not rated CVE-2023-21066 In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow Not rated

Track this CVE