CVE-2023-21237

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.003 · 18 %ileDEEUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

0.27% (18th) EPSS

CVSS 5.5 · medium

Is it mine?

3 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

added 2024-03-05remediate by 2024-03-26

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-25

Android Pixel Information Disclosure Vulnerability

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

cvss

Technical severity, 0–10. One row per scoring source.

6.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.16.2mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.16.2mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 2.5 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200US

affected products (3)

Products and version ranges known to be affected.

Google Android Pixelall versionscert_bundDEcpe:/o:google:android:pixel
n/a Android≤ Android-13enisa_euvdEU
google android= 13.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1458Google Pixel: Mehrere SchwachstellenDeutsch2023-06-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Pixel ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen, einen Denial of Service zu verursachen oder beliebigen Programmcode auszuführen.
PUB-A-2515869122023-06-01vendor · osvUS
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2023-06-28modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

https://cxsecurity.com/cveshow/CVE-2023-21237/cnnvd
https://source.android.com/security/bulletin/pixel/2023-06-01 cnnvd
https://source.android.com/security/bulletin/pixel/2023-06-01 enisa_euvd
https://source.android.com/security/bulletin/pixel/2023-06-01Vendor Advisorynvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21237Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan