CVE-2024-0036 Overview
CVE-2024-0036 is a local privilege escalation vulnerability in the Android operating system. The flaw resides in the startNextMatchingActivity method of ActivityTaskManagerService.java. A logic error in this method allows an attacker to bypass restrictions that prevent activities from being started from the background. Google addressed the issue in the Android Security Bulletin for February 2024. The vulnerability affects Android versions 11, 12, 12L, 13, and 14. Exploitation does not require user interaction and requires only low-privilege local access to the device.
Critical Impact
A local application with limited privileges can bypass background activity launch restrictions and escalate to higher privileges without user interaction.
Affected Products
- Google Android 11.0
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
Discovery Timeline
- 2024-02-01 - Google publishes the Android Security Bulletin containing the fix
- 2024-02-16 - CVE-2024-0036 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0036
Vulnerability Analysis
The vulnerability is a broken access control weakness classified under [CWE-284]. It affects the Android framework component responsible for managing activity task launches. Android enforces background activity launch (BAL) restrictions to prevent applications running in the background from starting new activities without an active foreground context. These restrictions exist to block tapjacking, phishing overlays, and unauthorized privilege transitions.
The startNextMatchingActivity path in ActivityTaskManagerService contained a logic error that fails to consistently apply BAL enforcement. A malicious application can invoke this path to launch activities outside the sanctioned lifecycle. The launched activity can execute with the calling identity or privileges that the background app should not have been able to obtain directly.
Root Cause
The root cause is a flawed permission check inside startNextMatchingActivity. The method did not correctly propagate or evaluate the caller's foreground state when dispatching the next matching activity. Google's fix in commit 3eaaa9687e90c65f51762deb343f18bef95d4e8e in the platform/frameworks/base repository adjusts the logic so background callers cannot use this pathway to bypass launch restrictions. See the Android Source Code Commit for the patch.
Attack Vector
An attacker must first place a malicious application on the target device. The application then invokes the vulnerable code path to trigger an activity start it would otherwise be forbidden to perform. Because the flaw allows the started activity to run with elevated context, the attacker can escalate privileges locally. No additional execution privileges and no user interaction are required. The vulnerability cannot be exploited remotely.
No verified public proof-of-concept code exists at the time of writing. Refer to the Android Security Bulletin February 2024 for the vendor's technical description.
Detection Methods for CVE-2024-0036
Indicators of Compromise
- Unexpected activity launches originating from applications that have no visible foreground component or recent user interaction.
- Third-party applications invoking framework activity launch APIs at unusual frequencies or from background service contexts.
- Devices running Android 11 through 14 without the February 2024 security patch level installed.
Detection Strategies
- Verify the ro.build.version.security_patch property on managed devices and flag any device with a patch level earlier than 2024-02-01.
- Use Mobile Device Management (MDM) compliance policies to require the February 2024 or later Android security patch level.
- Review logcat output for ActivityTaskManager warnings involving startNextMatchingActivity and background launch enforcement.
Monitoring Recommendations
- Monitor installed application lists on enterprise devices for sideloaded or untrusted packages requesting activity-related permissions.
- Correlate MDM telemetry with security patch level to identify devices exposed to Android framework vulnerabilities.
- Track vendor over-the-air (OTA) update distribution to ensure fleet-wide adoption of the February 2024 patch.
How to Mitigate CVE-2024-0036
Immediate Actions Required
- Install the Android security patch level 2024-02-01 or later on all affected devices.
- Apply device manufacturer OTA updates that include the February 2024 Android Security Bulletin fixes.
- Restrict installation of applications from untrusted sources through MDM policy.
Patch Information
Google released the fix in the Android Security Bulletin February 2024. The framework change is documented in the Android Source Code Commit. Device manufacturers integrate this patch into their own OTA update cycles, so patch availability varies by vendor and carrier.
Workarounds
- Disable installation of applications from unknown sources under Settings > Security until the patch is available for the device.
- Remove untrusted or unnecessary third-party applications, especially those requesting background execution capabilities.
- Enforce Google Play Protect and require verified applications through enterprise policy.
# Verify the installed Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2024-02-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
