CVE-2022-20448

What it actually does

Permissions bypass in NotificationManagerService.java allows an app running as one user to access notification data belonging to another user on the same device, resulting in unauthorized cross-user data exposure and local privilege escalation.

Why it matters to the business

On multi-user Android devices, an attacker with a low-privileged local account can read sensitive notification data from other users without additional privileges or user interaction, increasing risk of data leakage on shared or managed devices.

How an attack unfolds

An attacker with local access on an affected Android device invokes the buzzBeepBlinkLocked method through a malicious application or process; the missing permission check permits reading notification state and content belonging to other users on the device.

How to fix it

Apply the security patch released in the November 2022 Android Security Bulletin for Android versions 10 through 13; upgrade devices to the fixed builds that address A-237540408.

How to confirm the fix worked

Verify that devices are running a build containing the November 2022 security patch level or later; confirm the vulnerable code path in NotificationManagerService.java is no longer reachable without proper permissions.

Typical attack path

1. Obtain a local shell or install a malicious app on the target Android device
2. Trigger NotificationManagerService.buzzBeepBlinkLocked without the required cross-user permission
3. Read notification data belonging to other users
4. Escalate to higher privileges or exfiltrate exposed information

How to detect it

Review system logs for NotificationManagerService calls originating from one user context that reference data of another user; look for unusual cross-user notification queries in logcat or audit logs around the time of suspected access.

What your security team should do

• Prioritize deployment of Android security updates to all managed devices within 30 days
• Enforce device encryption and strong user separation policies on multi-user deployments
• Monitor Android security bulletin releases for backported fixes on older branches