CVE-2023-21266 Overview
CVE-2023-21266 is a local privilege escalation vulnerability affecting Google Android versions 11 through 13. The flaw resides in multiple functions of ActivityManagerService.java within the Android framework. A permissions bypass condition allows a malicious application to evade Google Play Protect controls without requiring user interaction. Successful exploitation grants an attacker elevated privileges on the affected device with no additional execution rights needed beforehand.
Critical Impact
Local applications can bypass Google Play Protect and escalate privileges silently, exposing user data and enabling persistent compromise on Android 11, 12, 12.1, and 13 devices.
Affected Products
- Google Android 11.0
- Google Android 12.0 and 12.1
- Google Android 13.0
Discovery Timeline
- 2023-10-06 - CVE-2023-21266 published to the National Vulnerability Database (NVD)
- 2024-06-01 - Fix referenced in the Android Security Bulletin June 2024
- 2025-05-05 - Last updated in NVD database
Technical Details for CVE-2023-21266
Vulnerability Analysis
The vulnerability is classified as an authorization bypass leading to local privilege escalation. It affects the Android system service responsible for managing application lifecycle and inter-component communication. Multiple functions within ActivityManagerService.java fail to correctly enforce permission checks before performing privileged operations. As a result, an unprivileged local application can perform actions that should be restricted by the Android permission model and Google Play Protect.
Exploitation requires only local access through an installed application. No user interaction is required, and the attacker does not need elevated privileges before triggering the flaw. The confidentiality, integrity, and availability of the device are all impacted upon successful exploitation.
Root Cause
The root cause is improper authorization logic across several code paths in ActivityManagerService. The service did not consistently validate caller permissions when handling specific activity management operations. This permitted a caller to invoke functionality reserved for higher-privileged components, effectively circumventing Play Protect runtime controls designed to flag malicious behavior. The upstream Android Open Source Project fix is committed at change fa94ce5c7738e449cb6bd68c77af4858018e49e0.
Attack Vector
The attack vector is local. A malicious or compromised application installed on the device invokes the vulnerable ActivityManagerService interfaces and triggers the missing authorization check. Because Play Protect screening can be evaded, the application avoids identification while obtaining privileged execution context. The vulnerability mechanism is described in the Android Source Code Update and the Android Security Bulletin June 2024. No verified public proof-of-concept code is available.
Detection Methods for CVE-2023-21266
Indicators of Compromise
- Applications invoking ActivityManagerService APIs that they have not declared corresponding permissions for in their manifest.
- Unexpected process spawning or activity starts originating from third-party packages with low install reputation.
- Apps that disable, uninstall, or interfere with Google Play Protect components shortly after installation.
Detection Strategies
- Inspect installed packages for declared permissions that do not match observed runtime behavior captured in logcat and ActivityManager traces.
- Use mobile threat defense tooling to flag applications performing privileged activity transitions without the necessary signature or platform permissions.
- Correlate Android security patch level against the June 2024 bulletin to identify devices still exposed.
Monitoring Recommendations
- Monitor enterprise mobile device management (MDM) telemetry for devices reporting a security patch level prior to 2024-06-01.
- Audit sideloaded applications and applications installed from outside the Google Play Store on managed fleets.
- Track abnormal foreground service or activity launches initiated by non-system UIDs.
How to Mitigate CVE-2023-21266
Immediate Actions Required
- Apply the Android security patch level dated 2024-06-01 or later on all Android 11, 12, 12.1, and 13 devices.
- Enforce minimum patch level policies through MDM and block non-compliant devices from accessing corporate resources.
- Restrict installation of applications from unknown sources on managed endpoints.
Patch Information
Google addressed CVE-2023-21266 in the Android Security Bulletin June 2024. The framework fix is published in the Android Open Source Project at commit fa94ce5c7738e449cb6bd68c77af4858018e49e0, which adds the missing permission enforcement in ActivityManagerService.java. Original equipment manufacturers (OEMs) ship the fix as part of their monthly Android security patch level beginning June 2024.
Workarounds
- Disable installation of third-party applications and require Google Play as the sole installation source.
- Ensure Google Play Protect remains enabled and configured to scan applications continuously.
- Retire or isolate end-of-life Android 11 devices that no longer receive vendor security updates.
# Verify current Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output should be 2024-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
