CVE-2023-21244

What it actually does

Missing permission check in visitUris of Notification.java allows an app running with User privileges to bypass user profile boundaries and access or manipulate data across profiles.

Why it matters to the business

Attackers with limited local access can gain elevated control over device functions and data belonging to other users on shared Android devices, increasing risk of data exposure or unauthorized actions without user interaction.

How an attack unfolds

An attacker with an app installed under a standard user profile crafts a notification containing URIs that target another profile; the missing permission validation in visitUris permits the operation to succeed, resulting in unauthorized cross-profile access and privilege escalation.

How to fix it

Apply the latest Android security patches from Google that address the missing permission check in Notification handling; monitor vendor update channels for affected device models and deploy updates as soon as available.

How to confirm the fix worked

Confirm devices are running patched Android builds by checking build fingerprints or security patch levels; review source code or binary analysis of Notification.java to verify permission checks are present around visitUris calls.

Typical attack path

1. Obtain User execution privileges on an Android device via installed application
2. Trigger visitUris processing in Notification.java with specially crafted URIs referencing another user profile
3. Bypass the absent permission check to perform actions across profile boundaries
4. Escalate to higher privileges within the target profile

How to detect it

Examine Android system logs and notification-related audit trails for anomalous cross-profile URI access attempts; review app behavior logs for unexpected profile boundary crossings.

What your security team should do

• Prioritize deployment of Android security updates across the fleet
• Restrict installation of untrusted applications on shared or multi-user devices
• Monitor for new exploit maturity indicators or public proof-of-concept releases