← Vulnerability feed

Vulnerability record · CVE-2023-20963 · published 24 March 2023

CVE-2023-20963: Android WorkSource parcel mismatch local privilege escalation

Google · Android

CVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional execution privileges. It affects Android 11, 12, 12L, and 13, and requires no user interaction. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it should be treated as actively exploited.

7.8 CVSS 3.1 High CISA KEV since 13 Apr 2023 EPSS 1.5% · top 27.4% CWE-295 · Improper certificate validation
7.8CVSS 3.1 base score
1.5%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with known exploitation, has a high CVSS score of 7.8, and affects widely used Android versions, though it requires local access.

What it is

CVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional execution privileges. It affects Android 11, 12, 12L, and 13, and requires no user interaction. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it should be treated as actively exploited.

Impact

A local attacker can gain elevated privileges on the device, potentially accessing data or capabilities beyond their normal app or user permissions. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The vulnerability is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). It is reached by a local app or process on the Android device, not over the network.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-04-13, indicating known exploitation in the wild. EPSS probability is low at 0.01465 (72nd percentile), but the KEV listing takes precedence for active exploitation status.

What to do

  • Apply the Android security bulletin patch for March 2023 (2023-03-01) or later vendor updates.
  • Verify that affected devices are running Android 11, 12, 12L, or 13 with the latest security patch level.
  • Restrict installation of untrusted apps and limit local attack surface where feasible.
  • Monitor CISA KEV guidance and vendor instructions for required actions.

Detection

  • Monitor for anomalous privilege escalation attempts or unexpected process elevation on Android devices.
  • Audit WorkSource-related API usage and parcel handling in app logs where available.
  • Track device security patch levels to identify unpatched Android 11-13 devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-20963 to the Known Exploited Vulnerabilities catalog on 13 April 2023 as "Android Framework Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 4 May 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://source.android.com/security/bulletin/2023-03-01 PatchVendor Advisory
https://source.android.com/security/bulletin/2023-03-01 PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20963 Third Party AdvisoryUS Government Resource

Track CVE-2023-20963 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2021-39793Android Mali GPU driver out-of-bounds write in kbase_jd_user_buf_pin_pagesThe Android kernel Mali GPU driver function kbase_jd_user_buf_pin_pages in mali_kbase_mem.c contains a logic error that causes an out-of-bounds write…KEVEPSS 0.69%analysed

Source: NIST National Vulnerability Database (record CVE-2023-20963), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.