CVE-2023-40076: Google Android Privilege Escalation Flaw

CVE-2023-40076 Overview

CVE-2023-40076 is a permissions bypass vulnerability in the Android CredentialManagerUi.java component. The flaw resides in the createPendingIntent function and allows a local application to access credentials belonging to other users on the same device. Google assigned this issue a CVSS 3.1 base score of 5.5 and addressed it in the December 2023 Android Security Bulletin. Exploitation requires local access and low privileges, but no user interaction. The vulnerability is classified under [CWE-276] Incorrect Default Permissions and results in local privilege escalation without additional execution privileges. Android 14 is the confirmed affected platform version.

Critical Impact
A local application can bypass user-isolation boundaries and access credentials stored by other users through the Credential Manager UI, enabling local privilege escalation.

Affected Products

Google Android 14.0
Android Open Source Project (AOSP) frameworks/base Credential Manager component
Devices running Android 14 prior to the 2023-12-01 security patch level

Discovery Timeline

2023-12-01 - Google publishes fix in the Android Security Bulletin
2023-12-04 - CVE-2023-40076 published to NVD
2025-05-29 - Last updated in NVD database

Technical Details for CVE-2023-40076

Vulnerability Analysis

The vulnerability exists in the createPendingIntent method of CredentialManagerUi.java, part of the Android Credential Manager framework introduced in Android 14. Credential Manager provides a unified API for password, passkey, and federated sign-in credentials. The createPendingIntent method constructs a PendingIntent that the system later launches on behalf of a caller. Because of incorrect permission handling, the constructed intent does not properly enforce the user boundary of the requesting caller. A local application running as one Android user can obtain a PendingIntent that, when fired, operates against credential storage belonging to a different user profile on the same device. This breaks the multi-user isolation guarantees that Android enforces between primary users, secondary users, and work profiles.

Root Cause

The root cause is incorrect default permissions [CWE-276] in the construction of the PendingIntent. The method failed to scope the intent to the caller's user identity or to validate that the target credential data belonged to the calling user. Android's PendingIntent mechanism executes with the identity of the creator, so a system-created PendingIntent runs with elevated system privileges. When that intent references credential data across user boundaries without enforcement, cross-user credential disclosure becomes possible.

Attack Vector

A malicious application installed under one Android user account invokes the Credential Manager UI flow and receives a PendingIntent from the system. The application triggers the intent in a manner that causes the system to operate against credentials stored under a different user. No additional permissions are required beyond those normally granted to an installed app, and no user interaction is required. The fix landed in AOSP commit 9b68987df85b681f9362a3cadca6496796d23bbc, which adjusts the intent construction to enforce the correct user handle. See the Android Source Code Reference for the patch.

Detection Methods for CVE-2023-40076

Indicators of Compromise

Installed applications invoking CredentialManager APIs shortly after installation without a corresponding user-driven credential workflow.
Logcat entries showing PendingIntent activity originating from the system Credential Manager but targeting credential records that do not match the active user ID.
Unexpected access events on credential providers from secondary user profiles or work profiles on the same device.

Detection Strategies

Audit installed applications on Android 14 devices for use of the androidx.credentials API and correlate with the device's patch level.
Inspect dumpsys output for the Credential Manager service to identify cross-user intent fulfillment that should not occur in normal operation.
Use mobile threat defense tooling to flag devices reporting a security patch level earlier than 2023-12-01 on Android 14.

Monitoring Recommendations

Enroll Android 14 devices in mobile device management (MDM) and continuously monitor the ro.build.version.security_patch property.
Alert on the installation of applications that request credential-related capabilities on devices that have not received the December 2023 patch.
Track multi-user and work-profile devices separately, as those configurations have the highest exposure to this cross-user issue.

How to Mitigate CVE-2023-40076

Immediate Actions Required

Update affected Android 14 devices to security patch level 2023-12-01 or later as documented in the Android Security Bulletin - December 2023.
Restrict installation of untrusted applications on shared or multi-user Android 14 devices until the patch is applied.
Review enterprise work-profile devices first, since these deployments most directly rely on user-isolation guarantees.

Patch Information

Google fixed CVE-2023-40076 in the December 2023 Android Security Bulletin. The upstream AOSP fix is commit 9b68987df85b681f9362a3cadca6496796d23bbc in platform/frameworks/base, which corrects the user scoping in createPendingIntent of CredentialManagerUi.java. Device manufacturers ship the corresponding fix in firmware updates that advance the security patch level to 2023-12-01 or later. End users should apply OEM updates through Settings > System > System update.

Workarounds

Avoid configuring multiple user profiles or work profiles on Android 14 devices until the December 2023 security patch is installed.
Limit application installation to vetted sources such as managed Google Play to reduce the likelihood of a malicious local app exploiting the flaw.
Where MDM is available, enforce a minimum security patch level policy and block non-compliant devices from accessing enterprise resources.

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2023-12-01 or later