{"id":"ASB-A-264029851", "published":"2023-09-01T00:00:00Z", "modified":"2026-07-09T15:25:53.339171538Z", "aliases":["CVE-2023-35674", "A-264029851"], "details":"In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"13-next:0"}, {"fixed":"13-next:2023-09-01"}]}], "versions":["13-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807"], "severity":"High", "spl":"2023-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["185024076188985592697592657200111398921", "255133638716784176650648678599829280208", "221334879092567230297954167268086863808", "104232059452926191079370652715497707313", "17577955838972545061065088638555892591", "340092115117716892634110623799607735440", "3955563167083734528194287429410886808", "142705210300934374365406619340716582477"], "threshold":0.9}, "id":"ASB-A-264029851-45f4d0bb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"40944750017110693121515483246201261836", "length":461}, "id":"ASB-A-264029851-faa2b792", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"onSurfaceShownChanged"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2023-09-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c"], "severity":"High", "spl":"2023-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["97260578544918248991463186177328886441", "119343172529379441452430847437454128779", "215138338139349316760125805301963934604", "48223376524673286516200772446024508334", "172239829722657991414987393139096621482", "334997900967039618802761655709050408035", "168345275794499243708915044743680084759", "108738882280443592871400280875675509294", "29356192979170191859971992315528918007", "210158276655113248346893409686026237450", "30214045548178003426689801848769202821"], "threshold":0.9}, "id":"ASB-A-264029851-1ae9f4f4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"282644488101311748694964662225614431131", "length":151}, "id":"ASB-A-264029851-c22b6fb2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"isNonToastOrStartingOrPrivatePresentation"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2023-09-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a"], "severity":"High", "spl":"2023-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"168749629929425575047631186685372659187", "length":566}, "id":"ASB-A-264029851-09170f03", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"onSurfaceShownChanged"}}, {"deprecated":false, "digest":{"line_hashes":["197372349787029204334728444664611643510", "309997718070563876267114674274505731218", "221334879092567230297954167268086863808", "104232059452926191079370652715497707313", "113282503497021672669107396203861564138", "4565792421663824132010776155881907794", "3955563167083734528194287429410886808", "142705210300934374365406619340716582477"], "threshold":0.9}, "id":"ASB-A-264029851-ee825087", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2023-09-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de"], "severity":"High", "spl":"2023-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"333509893200142190169172937928280843382", "length":573}, "id":"ASB-A-264029851-54d4deca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"onSurfaceShownChanged"}}, {"deprecated":false, "digest":{"line_hashes":["197372349787029204334728444664611643510", "309997718070563876267114674274505731218", "221334879092567230297954167268086863808", "104232059452926191079370652715497707313", "195434201744059629031553280034407819621", "4565792421663824132010776155881907794", "3955563167083734528194287429410886808", "142705210300934374365406619340716582477"], "threshold":0.9}, "id":"ASB-A-264029851-87fed0b0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"13:0"}, {"fixed":"13:2023-09-01"}]}], "versions":["13"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f"], "severity":"High", "spl":"2023-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"18693669996602847281805167538283739496", "length":426}, "id":"ASB-A-264029851-61afed30", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"onSurfaceShownChanged"}}, {"deprecated":false, "digest":{"line_hashes":["197372349787029204334728444664611643510", "309997718070563876267114674274505731218", "221334879092567230297954167268086863808", "104232059452926191079370652715497707313", "17577955838972545061065088638555892591", "340092115117716892634110623799607735440", "3955563167083734528194287429410886808", "142705210300934374365406619340716582477"], "threshold":0.9}, "id":"ASB-A-264029851-ccc1de09", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2023-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e"}]}