← Vulnerability feed

Vulnerability record · CVE-2023-21237 · published 28 June 2023

CVE-2023-21237: Android notification UI flaw hides foreground service alerts

Google · Android

In applyRemoteView of NotificationContentInflater.java, Android 13 mishandles notification UI so a foreground service notification can be hidden. The result is local information disclosure without extra execution privileges, and the record gives no further detail on the exact data exposed.

5.5 CVSS 3.1 Medium CISA KEV since 5 Mar 2024 EPSS 0.27% · top 83.4% CWE-200 · Information exposure
5.5CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with a required federal remediation deadline, though the CVSS is only 5.5 and EPSS is low.

What it is

In applyRemoteView of NotificationContentInflater.java, Android 13 mishandles notification UI so a foreground service notification can be hidden. The result is local information disclosure without extra execution privileges, and the record gives no further detail on the exact data exposed.

Impact

A local attacker can conceal a foreground service notification, hiding an ongoing activity from the device user and exposing information the notification would otherwise reveal.

Attack surface

Reached locally on the device through notification rendering; the CVSS vector AV:L/PR:L/UI:N indicates low privileges are required and no user interaction is needed.

Exploitation

CVE-2023-21237 is listed in CISA KEV with a 2024-03-05 addition date, but EPSS is low at 0.00264 (18th percentile) and no ransomware use is documented.

What to do

  • Apply the Android/Pixel security bulletin update for June 2023 or later to affected Android 13 devices.
  • If patching is not possible, follow CISA KEV required action and discontinue use of the affected product.
  • Restrict local access and untrusted app installation on Android 13 devices to reduce the low-privilege local attack path.
  • Monitor vendor bulletins for updated guidance on the affected Android 13 build.

Detection

  • Audit foreground service notifications on Android 13 devices for unexpected disappearance or suppression.
  • Review app behavior that manipulates remote views in notifications for signs of notification hiding.
  • Correlate device logs around NotificationContentInflater and applyRemoteView with suspicious local app activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-21237 to the Known Exploited Vulnerabilities catalog on 5 March 2024 as "Android Pixel Information Disclosure Vulnerability ". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 26 March 2024.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://source.android.com/security/bulletin/pixel/2023-06-01 Vendor Advisory
https://source.android.com/security/bulletin/pixel/2023-06-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21237 Third Party AdvisoryUS Government Resource

Track CVE-2023-21237 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed

Source: NIST National Vulnerability Database (record CVE-2023-21237), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.