6.2 Medium Exploited

CVE-2023-21237 Android Pixel Information Disclosure Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-200

Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

Affected products and versions

Product	Affected versions	Fixed in
Android	Versions not published
Android	13.0	No fix stated

References

source.android.com source.android.com

Timeline

Published June 28, 2023
Added to the KEV catalogue March 5, 2024
Last modified October 21, 2025

The 2441 CVEs of Android →

CVE-2023-21156 In BuildGetRadioNode of protocolmiscbulider.cpp, there is a possible out of bounds read due to improper input validation Not rated CVE-2023-21175 In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due… Not rated CVE-2023-21176 In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion Not rated CVE-2023-21177 In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is… Not rated

Track this CVE