CVE-2023-40073

What it actually does

The flaw permits a local application to read media content belonging to a different user profile by abusing a confused deputy condition during URI visitation inside the notification handling code.

Why it matters to the business

Organizations using shared or multi-user Android devices face risk of unauthorized exposure of private media files across user boundaries, increasing the chance of data leakage without user interaction.

How an attack unfolds

An attacker crafts a malicious application that issues intents or notifications triggering visitUris; the system resolves the supplied URIs under an unintended user context, returning media data directly to the attacking app.

How to fix it

Apply the latest Android security patch that corrects the URI handling logic in Notification.java; verify the device receives the update through official channels.

How to confirm the fix worked

Confirm the device runs a build containing the fix for CVE-2023-40073 by checking the security patch level; attempt controlled cross-user URI access tests in a lab environment to verify isolation.

Typical attack path

1. Install a malicious application on the target Android device
2. App constructs a notification or intent containing attacker-controlled URIs
3. Notification service processes the URIs without proper user isolation checks
4. Media files from another user profile are read and returned to the attacker
5. Attacker exfiltrates the disclosed media

How to detect it

Review system logs for notification URI processing events that cross user boundaries; monitor for apps performing unexpected media reads shortly after notification interactions.

What your security team should do

• Prioritize deployment of the Android security update addressing this issue
• Restrict installation of unvetted applications on multi-user devices
• Audit notification-related permissions granted to third-party apps