CVE-2023-21291

What it actually does

Missing permission check in visitUris of Notification.java allows an app with user privileges to read image contents belonging to another user or app on the same device.

Why it matters to the business

Sensitive images such as photos or documents can leak between apps or user profiles on shared Android devices, increasing risk of data exposure without requiring user interaction.

How an attack unfolds

An attacker with local user access crafts a notification containing URIs pointing to another user's images; the missing permission check in visitUris allows the images to be read and disclosed locally.

How to fix it

Apply the latest Android security patches that address the missing permission check in Notification.java; monitor vendor bulletins for device-specific updates.

How to confirm the fix worked

Confirm devices are running patched Android builds; test notification handling with cross-user URIs to verify permission enforcement.

Typical attack path

1. Obtain local user execution on an Android device
2. Trigger notification processing via visitUris
3. Supply URIs referencing another user's image content
4. Read and exfiltrate the disclosed image data

How to detect it

Review Android logs for notification processing events involving cross-user URIs; look for apps attempting to access image content without explicit permissions.

What your security team should do

• Prioritize patching Android devices to the latest security release
• Review app permissions and notification usage in internal Android applications
• Enable Android security logging and monitor for unusual notification activity