CVE-2024-0043: Google Android Privilege Escalation Flaw

CVE-2024-0043 Overview

CVE-2024-0043 is an authorization flaw [CWE-863] in the Android Permission module. A logic error in multiple code locations allows an application running in the work profile to be granted notification listener access it should not receive. An attacker who convinces a user to interact with a malicious app in the work profile can escalate privileges locally and read notifications belonging to other users or profiles on the device. The flaw affects Android versions 12, 12L, 13, and 14. Google addressed the issue in the May 2024 Android Security Bulletin.

Critical Impact
A malicious work-profile app can gain notification listener access without additional execution privileges, exposing sensitive notification content across profiles.

Affected Products

Google Android 12.0
Google Android 12.1 (12L)
Google Android 13.0
Google Android 14.0

Discovery Timeline

2024-05-07 - CVE-2024-0043 published to the National Vulnerability Database
2024-05-01 - Fix included in the Android Security Bulletin May 2024
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-0043

Vulnerability Analysis

The vulnerability resides in the Android Permission module that governs which applications may act as NotificationListenerService components. Notification listeners receive every posted notification on the device, including message content, one-time passwords, and authenticator codes. Android's multi-user model isolates the primary profile from the managed work profile, and applications in the work profile should not receive notifications posted for the primary user.

A logic error in the permission-granting flow allows an app installed in the work profile to obtain notification listener rights that bridge this boundary. Because the check evaluates the request incorrectly, the system treats the grant as legitimate once the user completes the standard listener-consent dialog.

The result is a local privilege escalation. The malicious app does not need additional execution privileges and does not require any special Android permission at install time beyond what a work-profile app can already request.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] in the Permission module. The code path that validates a notification listener request fails to correctly enforce the profile boundary between the work profile and the parent user. The upstream patch is committed to the AOSP packages/modules/Permission project at revision 8141e8f4dd77b9f8fb485e23ddf028c57fcd4fca.

Attack Vector

Exploitation requires local installation of a malicious application in the Android work profile and user interaction to approve the notification access dialog. Once approved, the app can read notifications outside the intended scope, enabling credential theft, message interception, and reconnaissance for follow-on attacks. The attack does not require networked delivery or elevated privileges before user consent.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-0043

Indicators of Compromise

Work-profile applications that declare android.permission.BIND_NOTIFICATION_LISTENER_SERVICE in their manifest and prompt for notification access.
Notification-access consent dialogs appearing shortly after a sideloaded or newly installed work-profile app launches.
Unexpected entries under Settings > Notifications > Device & app notifications referencing work-profile applications.

Detection Strategies

Inventory managed devices for Android build fingerprints predating the 2024-05-01 security patch level and flag those still on affected releases.
Use enterprise mobility management (EMM) or mobile threat defense telemetry to enumerate apps holding notification listener access inside the work profile.
Review Google Play Protect and app-vetting reports for work-profile applications requesting notification listener bindings without a clear business justification.

Monitoring Recommendations

Alert when a work-profile app is granted notification listener access on devices below the May 2024 patch level.
Monitor for anomalous outbound network activity from work-profile applications that hold notification listener rights.
Track the Android security patch level (ro.build.version.security_patch) across the mobile fleet and report devices lagging behind the current bulletin.

How to Mitigate CVE-2024-0043

Immediate Actions Required

Apply the Android security patch level 2024-05-01 or later on all Android 12, 12L, 13, and 14 devices.
Audit work-profile applications and revoke notification listener access for any app that does not require it.
Enforce an EMM policy that blocks sideloading and restricts work-profile installs to a vetted allowlist.

Patch Information

Google published the fix in the Android Security Bulletin May 2024. The corresponding source change is available in the Android Permission Module Update. OEM patch availability varies; verify that device vendors have shipped a build reporting a security patch level of 2024-05-01 or newer.

Workarounds

Until the patch is applied, disable notification listener access for all work-profile applications through EMM configuration.
Restrict which applications can be installed in the work profile using Google Play managed configurations.
Educate users to reject notification access prompts unless the requesting application is explicitly approved by IT.

bash

# Verify the Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-05-01 or later