Back to CVE Browser

CVE-2023-35674

🔥 Known Exploited (CISA KEV)HIGH

7.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-09-11

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Platforms (CPE)

💻

Google

Android

= 11.0= 12.0= 12.1= 13.0

References & Advisories

🔗 https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e

🔗 https://source.android.com/security/bulletin/2023-09-01

🔗 https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e

🔗 https://source.android.com/security/bulletin/2023-09-01

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35674

Related Security Intelligence Articles

Global Cyber Intel Digest: July 24, 2026

This digest covers active exploitation of Check Point CVE-2026-16232 SmartConsole authentication bypass, Russian LAUNDRY BEAR targeting Zimbra vulnerabilities, malicious Claude Desktop ad campaigns deploying SectopRAT, and Chaos ransomware msaRAT operations.

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2026-164047.4

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163976.5

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163737.5

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-159009.6

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandb...