CVE-2024-40672: Google Android Privilege Escalation Flaw

CVE-2024-40672 Overview

CVE-2024-40672 is a local privilege escalation vulnerability in the Android ChooserActivity component. The flaw resides in the onCreate method of ChooserActivity.java, where a missing permission check allows an attacker to bypass Factory Reset Protection (FRP). Exploitation requires local access but no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin dated October 1, 2024. The vulnerability affects Android versions 12, 12L, 13, and 14. It is tracked under CWE-281: Improper Preservation of Permissions.

Critical Impact
An attacker with local access to a locked or reset device can bypass Factory Reset Protection, gaining unauthorized access to a device that should require the previous owner's Google account credentials.

Affected Products

Google Android 12.0
Google Android 12.1 (12L)
Google Android 13.0
Google Android 14.0

Discovery Timeline

2024-10-01 - Google publishes fix in the Android Security Bulletin
2025-01-28 - CVE-2024-40672 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40672

Vulnerability Analysis

The vulnerability affects the Android IntentResolver module, specifically the onCreate method of ChooserActivity.java. ChooserActivity is the system component that renders the share sheet and intent disambiguation dialog. The onCreate method lacks a required permission check before processing intents. An attacker can invoke the activity in a state where Factory Reset Protection should block access, and the missing check permits actions that would otherwise be gated on ownership verification.

Factory Reset Protection (FRP) is designed to prevent thieves from wiping a stolen device and reusing it. The device requires the prior Google account credentials during initial setup after a reset. By reaching ChooserActivity before setup completes, an attacker can launch other components and bypass the setup-required state. This produces local escalation of privilege because the attacker moves from a locked, unusable device state to interactive access.

Root Cause

The root cause is a missing permission check in ChooserActivity.onCreate [CWE-281]. The activity did not verify that the caller was authorized to launch intent chooser flows during the pre-setup FRP state. Google's fix in the Android IntentResolver commit adds the missing enforcement.

Attack Vector

Exploitation requires physical, local access to a device that has been factory reset and is in the FRP-protected setup flow. The attacker triggers the vulnerable ChooserActivity path through an accessible UI element or a companion accessory intent. Because no additional privileges or user interaction beyond attacker-driven input are required, an adversary in possession of a stolen device can reach the exploit path directly.

No verified public exploit code is available. See the Android IntentResolver Update for the patch diff illustrating the added permission enforcement.

Detection Methods for CVE-2024-40672

Indicators of Compromise

Devices reaching the home screen or app launcher without completion of the post-reset Google account verification step.
Unexpected invocation of ChooserActivity (com.android.intentresolver.ChooserActivity) during the initial setup wizard flow.
Enrolled devices in a mobile device management (MDM) console reporting an owner account that does not match the pre-reset owner.

Detection Strategies

Mobile threat defense tooling should flag devices running Android 12 through 14 that lack the October 2024 security patch level.
Enterprise mobility platforms should identify enrolled devices whose reported build fingerprint predates the fix in the October 2024 Android Security Bulletin.
Endpoint agents on managed Android devices should alert on abnormal activity launches from the setup wizard user context.

Monitoring Recommendations

Track the ro.build.version.security_patch property across the fleet and enforce a minimum of 2024-10-01.
Monitor MDM inventory for factory reset events followed by rapid re-enrollment with different accounts, which may indicate FRP bypass attempts.
Review device attestation results from Play Integrity to identify tampered or bypassed setup states.

How to Mitigate CVE-2024-40672

Immediate Actions Required

Apply the October 2024 Android security patch (patch level 2024-10-01 or later) to all managed devices running Android 12, 12L, 13, and 14.
Enforce a minimum security patch level policy in your MDM or unified endpoint management platform, quarantining non-compliant devices.
For lost or stolen devices, initiate remote wipe and disable IMEI or serial number in carrier and MDM systems rather than relying solely on FRP.

Patch Information

Google released the fix in the Android Security Bulletin — October 2024. The corrective change is committed in the Android IntentResolver module. See the upstream patch, which adds the missing permission enforcement to ChooserActivity.onCreate. Original Equipment Manufacturers (OEMs) integrate the fix through monthly Android security patch updates.

Workarounds

No software workaround exists prior to patching; physical control of the device is the only compensating control.
Enable strong screen lock credentials and Google Find My Device to reduce the impact of theft while patches are deployed.
Restrict enterprise-owned Android devices to fully managed mode with zero-touch enrollment so that FRP bypass does not yield useful access.

bash

# Verify the security patch level on an Android device via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-10-01 or later

# List devices below the required patch level via MDM CLI (example, Android Enterprise)
gcloud beta androidmanagement devices list \
  --enterprise=enterprises/LC0123abcd \
  --filter="softwareInfo.androidBuildTime<2024-10-01"