CVE-2023-44129: google android

Vulnerability summary

CVE-2023-44129 is a low (CVSS 3.6) vulnerability in google android. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.8% of scored vulnerabilities.

Timeline

1. 27-09-2023
   PublishedVulnerability first disclosed.
2. 23-09-2024
   Last modifiedVulnerability information updated.

Description

The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" action. The attacker can send, e.g., their own data/clipdata and set Intent.FLAG_GRANT_* flags. After the attacker received that intent in the "onActivityResult()" method, they would have access to arbitrary content providers that have the `android:grantUriPermissions="true"` flag set.

• CWE-926Improper Export of Android Application ComponentsThe Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.