Threats Tagged 'cve-2023-35674'

CVE-2023-35674 is a high-severity local privilege escalation vulnerability in Google Android versions 11 through 13, caused by a logic error in WindowState.java's onCreate method. This flaw allows an attacker with limited privileges to launch a background activity, escalating their privileges without requiring additional execution rights or user interaction. The vulnerability impacts confidentiality, integrity, and availability, enabling potential full system compromise. Exploitation does not require user interaction but does require local access with some privileges. No known exploits are currently in the wild, but the vulnerability's critical nature and broad Android version impact make it a significant risk. European organizations using affected Android devices, especially in sectors with sensitive data, face elevated risks. Mitigation involves applying official patches once available, restricting local access, and monitoring for suspicious activity related to background activity launches. Countries with high Android adoption and critical infrastructure reliance on mobile devices, such as Germany, France, and the UK, are most likely to be affected. Given the CVSS score of 8.

HighVulnerabilityGermanyFranceItaly+5#cve#cve-2023-35674