CVE-2023-21105

What it actually does

Confused deputy in ChooserActivity.java allows a local process to read media files belonging to another user on the same device without additional privileges.

Why it matters to the business

Attackers with local access can obtain private media files such as photos or videos from other user profiles, resulting in privacy violations and potential regulatory exposure on affected Android devices.

How an attack unfolds

An attacker with a local account invokes the media chooser through multiple functions in ChooserActivity.java; the confused deputy fails to enforce user boundaries, returning cross-user media content directly to the caller with no user interaction required.

How to fix it

Apply the latest Android security patch level that resolves A-261036568; upgrade devices to Android 14 or newer where the issue is addressed, and verify patch installation through device settings or enterprise mobile management.

How to confirm the fix worked

Confirm the device reports a security patch level after June 2023, review source history for ChooserActivity.java changes addressing the confused deputy, and test that cross-user media URIs are no longer returned to unprivileged callers.

Typical attack path

1. Obtain local execution on an affected Android device
2. Invoke ChooserActivity via an installed application or adb shell
3. Trigger one of the vulnerable media-selection functions
4. Receive file descriptors or URIs pointing to another user's media
5. Read and exfiltrate the disclosed media content

How to detect it

Review Android logs for unusual ChooserActivity invocations or media URI requests from non-system processes; examine app behavior for unexpected access to other profiles' content providers.

What your security team should do

• Prioritize patching all managed Android 11-13 devices to the June 2023 or later security patch level
• Enforce automatic system updates via enterprise policy
• Disable or restrict local ADB and unknown-source app installation on high-risk devices
• Monitor vendor bulletins for back-port fixes on older releases