Back to CVE Browser

CVE-2024-43093

🔥 Known Exploited (CISA KEV)HIGH

7.3

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-11-13

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Platforms (CPE)

💻

Google

Android

= 12.0= 12.1= 13.0= 14.0= 15.0

References & Advisories

🔗 https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10

🔗 https://source.android.com/security/bulletin/2025-03-01

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093

Related Security Intelligence Articles

Global Cyber Intel Digest: July 24, 2026

This digest covers active exploitation of Check Point CVE-2026-16232 SmartConsole authentication bypass, Russian LAUNDRY BEAR targeting Zimbra vulnerabilities, malicious Claude Desktop ad campaigns deploying SectopRAT, and Chaos ransomware msaRAT operations.

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2026-164047.4

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163976.5

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163737.5

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-159009.6

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandb...