CVE DatabaseCVE-2023-21237

Updated 2026-06-17한국어 권고문 →

CVE-2023-212375.5/MEDIUMCISA KEVCWE-200

Android 13 Notification System UI Bypass and Local Information Disclosure (CVE-2023-21237)

⚡ Jump to Patch

Affected Vendors

google, android

Affected Components

android

Published Date

2023-06-28

CVSS v3.1

5.5

MEDIUM

EPSS (30d)

0.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Android 13 operating system (Android-13, Android ID: A-251586912)

Impact

Attackers can hide mandatory foreground service notifications without user interaction, enabling stealthy background execution and unauthorized local information disclosure

Mitigation

Apply the official June 2023 (or later) Android security patch and restrict notification permissions for untrusted applications

Affected Products & Version Scope

Android 13 (Android-13, Android ID: A-251586912)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Users must update their Android 13 devices to the security patch level of 2023-06-01 or later.

bash

# Verify the current security patch level of the connected Android device via ADB
adb shell getprop ro.build.version.security_patch
# Ensure the output date is '2023-06-01' or later.

2. Temporary Workaround & Hardening Configuration

If an immediate OS update is not feasible, administrators should restrict notification and background execution permissions for unverified third-party applications.

bash

# Revoke notification permissions for a specific suspicious package
adb shell appops set <package_name> POST_NOTIFICATIONS deny

# Restrict background execution for the target package
adb shell appops set <package_name> RUN_IN_BACKGROUND deny

3. Log Audit & IoC Verification Commands

Monitor system logs for anomalies or errors related to NotificationContentInflater and custom RemoteViews rendering.

bash

# Filter system logs for potential exploitation attempts or rendering anomalies
adb logcat | grep -E 'NotificationContentInflater|RemoteViews|applyRemoteView'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild, immediately update all Android 13 endpoints to the June 2023 or later security patch level.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-21237) resides in the applyRemoteView method of NotificationContentInflater.java within Android 13. The Android operating system is designed to display persistent notifications for foreground services to ensure users are aware of background activities. However, a logic flaw in handling custom RemoteViews allows an application to construct misleading or insufficient UI layouts, effectively rendering the mandatory notification invisible or highly obscured to the user.

2. Exploitation Mechanics & Attack Scenario

A local malicious application with no special execution privileges can exploit this vulnerability. By registering a foreground service and inflating a specially crafted RemoteViews object, the attacker can manipulate layout parameters (such as setting dimensions to zero, applying full transparency, or positioning elements off-screen). Because NotificationContentInflater.java fails to properly validate and enforce the visibility of critical notification elements, the system hides the active foreground service notification. This allows the malware to run silently in the background, harvesting sensitive local data (e.g., location, media, or keystrokes) without any user interaction.

3. Infrastructure & Business Impact

As this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, active exploitation in the wild has been confirmed. In an enterprise environment, compromised mobile endpoints can serve as a silent entry point for corporate espionage. Attackers can bypass multi-factor authentication (MFA) prompts, intercept sensitive communications, and exfiltrate corporate credentials without triggering any visual indicators on the user's device, posing a severe threat to zero-trust mobile architectures.

Official Vendor Advisories & References

NVD Original English Description

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

https://source.android.com/security/bulletin/pixel/2023-06-01

Source: security@android.com · Vendor Advisory

https://source.android.com/security/bulletin/pixel/2023-06-01

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21237

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory, US Government Resource

Frequently Asked SecOps Questions (CVE-2023-21237)

FAQ

Q1. How critical is CVE-2023-21237 and is it actively exploited in the wild?

CVE-2023-21237 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-21237?

Primary impacted vendors include google, android across android. Scope summary: Android 13 (Android-13, Android ID: A-251586912)

Q3. What temporary mitigations or workarounds exist for CVE-2023-21237 before patching?

[Mitigation] Apply the official June 2023 (or later) Android security patch and restrict notification permissions for untrusted applications Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION