CVE-2023-21097

In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local…

High7.8EPSS 0.20%

Published: 19 Apr 2023
Updated: 5 Feb 2025
Reserved: 3 Nov 2022
Assigned by: google_android

Description

In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261858325

Scores

CVSS scores of CVE-2023-21097, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.20% · top 90% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

Elevation of privilege
CWE-610 Externally Controlled Reference to a Resource in Another Sphere (opens in a new tab)All about CWE-610 and its CVEs

Affected products

Android
- affected Android-11 Android-12 Android-12L Android-13

References (1)

https://source.android.com/security/bulletin/2023-04-01 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-21097](https://trackcve.app/badge/CVE-2023-21097.svg)](https://trackcve.app/cve/CVE-2023-21097)

Record last updated 5 Feb 2025, 15:34 UTC.