CVE-2023-35668

What it actually does

Confused deputy flaw in visitUris of Notification.java permits an app to cause the system to resolve and display image URIs belonging to another app or user without proper authorization checks.

Why it matters to the business

Sensitive images or visual data from one app can be leaked to another app on the same device, undermining user privacy and potentially exposing personal or confidential content.

How an attack unfolds

An attacker with a malicious app on the device constructs a notification containing crafted URIs; the system resolves those URIs in the context of another app, retrieving and displaying images the attacker should not access.

How to fix it

Update affected Android devices to the latest security patch level that resolves the issue in Notification.java; apply vendor-supplied fixes for the confused deputy authorization check.

How to confirm the fix worked

Verify device is running a patched Android build; review notification-related code paths and confirm URI access controls prevent cross-app image retrieval.

Typical attack path

1. Install malicious app on target device
2. Create notification object with URIs pointing to another app's content
3. Invoke visitUris to trigger URI resolution
4. Capture or display resulting images via the notification UI

How to detect it

Examine notification logs and system services for unexpected URI resolutions across app boundaries; review audit logs for notification creation events that reference foreign content providers.

What your security team should do

• Prioritize patching Android devices to the current security patch level
• Monitor for any vendor advisories or OEM updates addressing this authorization bypass
• Limit unnecessary notification permissions for third-party apps
• Educate users on keeping devices updated