CVE-2023-21237Android Pixel Information Disclosure Vulnerability

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

6.2 MEDIUMEPSS 0.26%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 05:32 UTC

OverviewCVSS details

6.2MEDIUMCVSS 3.1

Score source: CISA-ADP
NVD status: Analyzed
Published: Jun 28, 2023
Assigner: google_android

Affected

Android

Versions: Android-13

Exploitation

Public exploit: None listed
CISA KEV: Listed · Mar 5, 2024
KEV due date: Mar 26, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.26%chance of exploitation in 30 days

Higher than 18.57% of CVEs

CVSS 3.1 · CISA-ADP

6.2Medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 3.1 · NVD

5.5Medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.2	MEDIUM	3.1CISA-ADP	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5.5	MEDIUM	3.1NVD	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Mar 26, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2023-21237
Status: Analyzed
Assigner (CNA): google_android
Published: Jun 28, 2023
Last modified: 2026-06-17 05:32 UTC
Weaknesses: CWE-200

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 13:35 UTC.