CVE-2024-0021 Overview
CVE-2024-0021 is a local privilege escalation vulnerability in Google Android affecting the onCreate method of NotificationAccessConfirmationActivity.java. A logic error allows an application running in the Android work profile to enable notification listener services that should remain restricted. Successful exploitation requires user interaction but no additional execution privileges. The flaw impacts Android 13 and Android 14 and was addressed in the January 2024 Android Security Bulletin. The weakness is tracked under [CWE-20] Improper Input Validation.
Critical Impact
An app confined to the Android work profile can escalate privileges by enabling notification listener services, exposing notification content from other profiles and users.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Devices receiving security patch level prior to 2024-01-01
Discovery Timeline
- 2024-01-01 - Fix included in the Android Security Bulletin January 2024
- 2024-02-16 - CVE-2024-0021 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0021
Vulnerability Analysis
The vulnerability resides in NotificationAccessConfirmationActivity.java, part of the Android Settings package. This activity presents the confirmation dialog shown to a user when an app requests access to become a notification listener service. A logic error in the onCreate method fails to correctly restrict which callers may complete the confirmation flow when operating within an Android work profile.
Android's work profile is designed to isolate enterprise apps and data from personal apps on the same device. Granting a notification listener the ability to read notifications system-wide breaks that boundary. An app in the work profile that obtains notification listener access can read notification content, including messages, one-time passcodes, and application metadata from the primary user profile.
The issue is categorized as improper input validation [CWE-20] combined with a logic error in profile-scoped permission handling.
Root Cause
The root cause is a logic flaw in the onCreate handler of NotificationAccessConfirmationActivity. The activity does not correctly validate the calling profile context before allowing the notification listener grant to proceed. As a result, an install in the work profile can drive the confirmation flow and receive an elevated capability. The upstream fix is available in the Android Open Source Project (AOSP) commit 53ea491d276f9a7c586c7983c08105a9bb7051f1 in platform/packages/apps/Settings.
Attack Vector
Exploitation is local and requires user interaction. An attacker distributes a malicious app that is installed into the work profile, for example through a compromised enterprise app catalog or sideload. The app then triggers the vulnerable notification access confirmation flow. When the user taps to confirm, the logic error grants notification listener privileges that should not be available from the work profile. The malicious app can then read notifications outside its intended scope, enabling local escalation of privilege. See the Android Security Bulletin January 2024 for advisory details.
Detection Methods for CVE-2024-0021
Indicators of Compromise
- Applications in the work profile listed as active notification listeners in Settings > Apps > Special app access > Notification access.
- Enterprise Mobility Management (EMM) or Mobile Device Management (MDM) logs showing work-profile apps invoking NotificationListenerService.
- Unexpected NotificationAccessConfirmationActivity launches originating from work-profile package UIDs in system logs.
Detection Strategies
- Inventory installed work-profile applications and cross-reference which have been granted BIND_NOTIFICATION_LISTENER_SERVICE.
- Query MDM telemetry for the Android security patch level and flag devices reporting a patch level earlier than 2024-01-01.
- Review app permission audit trails for grants of notification access to non-approved work-profile apps.
Monitoring Recommendations
- Enforce continuous compliance checks through MDM to confirm Android 13 and Android 14 devices receive the January 2024 or later security patch level.
- Alert on new notification listener grants originating from managed profiles.
- Restrict work-profile app installation sources to the managed Google Play catalog only.
How to Mitigate CVE-2024-0021
Immediate Actions Required
- Apply the Android security patch level 2024-01-01 or later on all managed Android 13 and Android 14 devices.
- Audit current notification listener grants in both personal and work profiles and revoke access for any unrecognized applications.
- Enforce managed Google Play as the only app source for work profiles through MDM policy.
Patch Information
Google addressed CVE-2024-0021 in the Android Security Bulletin January 2024. The code change is available in the Android Settings code change. Original equipment manufacturers (OEMs) integrate this patch into their monthly device updates. Users must install the OEM update that reports a security patch level of 2024-01-01 or newer.
Workarounds
- Disable installation of unknown apps in the work profile using MDM policies until the patch is applied.
- Manually revoke notification listener access from any work-profile app in Settings > Apps > Special app access > Notification access.
- Deploy allowlists in the MDM to restrict which work-profile apps can request sensitive special app access permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
