CVE-2023-35674VulnerabilityPublished 11 Sep 2023Updated 21 Oct 2025

CVE-2023-35674: Google Android · Elevation of privilege

Affects Google AndroidSource CVE Database V5

Exploited in the wild · KEV due 4 Oct 2023 · 2% EPSS : apply the vendor's fix or mitigations to Google Android now.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

8.8High

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 4 Oct 2023 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 2.6% chance of exploitation in 30 days – higher than 85% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 11 Sep 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by google_android
2023-06-1502:50Z, 88 days before disclosure
CVE published
on cve.org
2023-09-1120:09Z, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
2023-09-13, 2 days after disclosure
KEV remediation due
US federal deadline
2023-10-04, 23 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected software

Product	Affected	Fixed in
Google Android	Affected =13 =12 =11	Fixed in–

Description

CVE-2023-35674 is a high-severity local privilege escalation vulnerability in Google Android versions 11 through 13, caused by a logic error in WindowState.java's onCreate method. This flaw allows an attacker with limited privileges to launch a background activity, escalating their privileges without requiring additional execution rights or user interaction. The vulnerability impacts confidentiality, integrity, and availability, enabling potential full system compromise. Exploitation does not require user interaction but does require local access with some privileges. No known exploits are currently in the wild, but the vulnerability's critical nature and broad Android version impact make it a significant risk. European organizations using affected Android devices, especially in sectors with sensitive data, face elevated risks. Mitigation involves applying official patches once available, restricting local access, and monitoring for suspicious activity related to background activity launches. Countries with high Android adoption and critical infrastructure reliance on mobile devices, such as Germany, France, and the UK, are most likely to be affected. Given the CVSS score of 8.

Impact

For European organizations, the impact of CVE-2023-35674 is significant due to the widespread use of Android devices in both personal and professional contexts. The vulnerability allows attackers with local access to escalate privileges, potentially gaining control over devices that handle sensitive corporate data, communications, and access to internal networks. This can lead to data breaches, unauthorized access to confidential information, and disruption of business operations. Sectors such as finance, healthcare, government, and critical infrastructure are particularly at risk because compromised devices could serve as entry points for broader network intrusions or espionage. The absence of required user interaction lowers the barrier for exploitation, increasing the threat level. Additionally, the vulnerability's impact on confidentiality, integrity, and availability means that attackers could not only steal data but also modify or delete it, or disrupt device functionality. The potential for persistent compromise raises concerns about long-term security and trust in mobile device ecosystems within European enterprises.

Mitigation

1. Apply official security patches from Google and device manufacturers promptly once they become available to remediate the vulnerability. 2. Until patches are deployed, restrict physical and local access to Android devices, especially in sensitive environments, to reduce the risk of local exploitation. 3. Implement mobile device management (MDM) solutions to enforce security policies, monitor device behavior, and restrict installation of untrusted applications. 4. Monitor logs and system behavior for unusual background activity launches or privilege escalations that could indicate exploitation attempts. 5. Educate users about the risks of granting unnecessary permissions to applications and the importance of device security hygiene. 6. Consider deploying endpoint detection and response (EDR) tools capable of detecting anomalous activity on Android devices. 7. For organizations with critical data, consider network segmentation and limiting Android device access to sensitive systems until the vulnerability is mitigated. 8. Collaborate with vendors and security communities to stay informed about exploit developments and mitigation best practices.

Summary

CVE-2023-35674 is a vulnerability in the Android operating system affecting versions 11, 12, 12L, and 13. The issue arises from a logic error in the onCreate method of the WindowState.java component, which is responsible for managing window states and activities within the Android framework. Specifically, this flaw allows an attacker with limited privileges to launch a background activity unexpectedly, bypassing normal security controls. This leads to a local elevation of privilege without requiring additional execution privileges or user interaction, making exploitation more straightforward for an attacker with local access. The vulnerability is categorized under CWE-269 (Improper Privilege Management), indicating that the system fails to enforce proper privilege boundaries. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no user interaction required. Although no known exploits are currently reported in the wild, the vulnerability's nature means it could be leveraged to gain unauthorized access to sensitive data or control over the device. This could facilitate further attacks such as data exfiltration, installation of persistent malware, or disruption of device functionality. The vulnerability affects a broad range of Android versions, which are widely deployed across consumer and enterprise devices globally. The lack of available patches at the time of reporting increases the urgency for mitigation and monitoring.

CWE-269Improper Privilege Management (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design · Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
Attack patterns
Restful Privilege Elevation (opens in a new tab)
Privilege Abuse (opens in a new tab)
Privilege Escalation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Oct 2025, 23:51 UTC

WeaknessesCWE-269

Technical details

References

Community reviews

Related threats