CVE-2024-34737 Overview
CVE-2024-34737 is a local privilege escalation vulnerability in the Android operating system. The flaw resides in the ensureSetPipAspectRatioQuotaTracker method of ActivityClientController.java, part of the Android frameworks base. A logic error allows a local application to generate picture-in-picture (PiP) windows that cannot be moved or dismissed by the user. Google patched the issue in the August 2024 Android Security Bulletin. Exploitation requires local access with low privileges but no user interaction.
Critical Impact
A local attacker can create persistent, unmovable, and undeletable picture-in-picture windows that lead to local escalation of privilege without requiring additional execution privileges or user interaction.
Affected Products
- Google Android 12.0
- Google Android 12.1, 13.0
- Google Android 14.0
Discovery Timeline
- 2024-08-01 - Google publishes fix in Android Security Bulletin
- 2024-08-15 - CVE-2024-34737 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34737
Vulnerability Analysis
The vulnerability exists in the Android Activity Manager component that governs application task and window lifecycle. Specifically, the ensureSetPipAspectRatioQuotaTracker method in ActivityClientController.java enforces rate limiting on picture-in-picture aspect ratio changes. A logic error in this quota-tracking routine allows a local application to invoke the PiP API in a manner that produces window instances the framework cannot subsequently move or remove.
Because the resulting PiP window bypasses normal lifecycle controls, the attacking application effectively persists UI elements outside its own sandbox. This condition enables escalation of privilege at the local level, since the misbehaving window can operate with framework-managed persistence normally reserved for privileged system UI. NVD assigns [CWE-noinfo] pending further categorization, and the underlying weakness aligns with a business logic error in resource lifecycle enforcement.
Root Cause
The root cause is an incorrect state check inside the aspect-ratio quota tracker. The framework fails to correctly reconcile PiP window state after certain aspect-ratio update sequences, leaving the window reference in a state where subsequent moveTaskToBack, removeTask, or dismiss operations do not act on it. Google's patch commit 8b473b3f79642f42eeeffbfe572df6c6cbe9d79e in platform/frameworks/base corrects the state validation path.
Attack Vector
Exploitation is local. A malicious application installed on the device must hold only the standard permissions required to enter picture-in-picture mode. By invoking the vulnerable code path with crafted aspect-ratio parameters, the app generates a PiP window that the user cannot close and that other system controls cannot reposition. This enables persistent overlay attacks, tapjacking scenarios, and interference with legitimate applications, forming the basis of privilege escalation. See the Android Security Bulletin August 2024 for vendor detail.
Detection Methods for CVE-2024-34737
Indicators of Compromise
- Persistent picture-in-picture windows that ignore user dismissal gestures or swipe-away actions.
- Applications repeatedly invoking setPictureInPictureParams with anomalous aspect-ratio values outside the documented 0.418 to 2.39 range.
- Unexpected PiP windows spawned by applications that do not normally use media playback or video-calling features.
Detection Strategies
- Inspect logcat output for repeated WindowManager and ActivityTaskManager messages referencing PiP aspect-ratio quota enforcement.
- Audit installed applications for use of the android.software.picture_in_picture feature combined with elevated foreground service usage.
- Correlate device build fingerprint against the August 2024 Android security patch level (2024-08-01) to identify unpatched endpoints.
Monitoring Recommendations
- Deploy mobile threat defense telemetry to flag applications abusing PiP APIs or holding UI elements after task termination.
- Track Android security patch levels across the managed fleet through MDM inventory reporting.
- Monitor Play Protect and enterprise app-vetting pipelines for applications requesting PiP capabilities without a corresponding media use case.
How to Mitigate CVE-2024-34737
Immediate Actions Required
- Apply the Android security patch level 2024-08-01 or later on all Android 12, 12.1, 13, and 14 devices.
- Enforce mobile device management policies that block installation of applications from untrusted sources.
- Review enterprise application inventories and remove apps that request picture-in-picture capability without a documented business need.
Patch Information
Google released the fix in the Android Security Bulletin August 2024. The upstream code change is available in the Google Source Code Commit to platform/frameworks/base. Original equipment manufacturers integrate this patch into their monthly device updates; end users should install the latest OTA update offered by their device vendor.
Workarounds
- Disable picture-in-picture mode on managed devices through MDM configuration where the feature is not required.
- Restrict app installation to vetted enterprise or Google Play catalogs and enable Google Play Protect scanning.
- Educate users to force-stop and uninstall any application producing PiP windows that cannot be dismissed through normal gestures.
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-08-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
