返回 CVE 瀏覽器

CVE-2023-35674

🔥 Known Exploited (CISA KEV)HIGH

7.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-09-11

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Platforms (CPE)

💻

Google

Android

= 11.0= 12.0= 12.1= 13.0

References & Advisories

🔗 https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e

🔗 https://source.android.com/security/bulletin/2023-09-01

🔗 https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e

🔗 https://source.android.com/security/bulletin/2023-09-01

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35674

相關資安分析文章

全球網絡威脅情報摘要：2026 年 7 月 24 日

本期情報聚焦於 Check Point CVE-2026-16232 SmartConsole 控制平面身分驗證繞過之主動利用、俄羅斯 LAUNDRY BEAR 利用 Zimbra 漏洞進行電子郵件間諜活動，以及假冒 Claude Desktop 的惡意廣告攻擊與 Chaos 勒索軟體運作動態。

全球網絡威脅情報摘要：2026 年 7 月 20 日

本期報告深入技術拆解 UTA0533 利用 SonicWall SMA1000 零日漏洞鏈進行 root 權限執行攻擊、NGINX 正規表示式堆疊毀損 DoS 漏洞 (CVE-2026-42533)，以及 Sandworm (UAC-0145) ClickFix 偽造驗證碼攻擊手法。

相關漏洞威脅

CVE-2026-164047.4

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163976.5

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163737.5

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-159009.6

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandb...