CVE-2023-21260 — Origin Validation Error in Google Android

CWE-346 — Origin Validation Error2 documents2 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Android
Timeline
PublishedJul 13

Description

In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be appeared as a system message for user confirmation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5google/android13, 12L, 12, 11
▶NVDgoogle/android4 versions+3

🔴Vulnerability Details

1
GHSA
GHSA-q4vr-5vjm-65rv: In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and↗2023-07-13
▶