CVE-2023-35674

CVE-2023-35674 is a privilege escalation flaw in the Android Framework caused by a logic error in the onCreate function of WindowState.java, which allows a background activity to be launched incorrectly. It is triggered by code already running on the device: an app with no special permissions can exploit the logic error, and no user interaction is required for exploitation. A successful attacker gains local escalation of privilege with high impact on the confidentiality, integrity, and availability of the affected device. Any Android device running an unpatched Android Framework build is in scope, and Google addressed the flaw in a monthly Android security update. The vulnerability was actively exploited as a zero-day and was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-13; no public proof-of-concept is known.

What to do: Apply the latest monthly Android security update delivered by Google or the device OEM as soon as it is available, and verify each device's Android security patch level reflects the fixed release; no workaround is documented in the available data. As an entry on the CISA KEV catalog, federal and critical-infrastructure organizations are required to apply the vendor fix or discontinue use per the KEV required action. Since exploitation requires code already running locally on the device, prioritize patching devices that install untrusted or third-party apps.