CVE-2024-40676 Overview
CVE-2024-40676 is a local privilege escalation vulnerability in the Android AccountManagerService.java component. The flaw resides in the checkKeyIntent method, which fails to properly validate intents due to a confused deputy condition [CWE-843: Type Confusion]. An attacker with local access can bypass the intent security check and install an unknown application without additional execution privileges. Exploitation requires no user interaction, increasing the risk on affected devices. Google addressed the issue in the Android Security Bulletin October 2024.
Critical Impact
Local attackers can bypass Android's intent validation to install arbitrary applications and escalate privileges without user interaction.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2025-01-28 - CVE-2024-40676 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-40676
Vulnerability Analysis
The vulnerability affects the checkKeyIntent function inside AccountManagerService.java, a privileged system service responsible for managing user account authenticators. The service validates intents received from authenticator apps before launching them on behalf of the caller. Due to a confused deputy weakness, the validation logic can be bypassed, allowing an intent to reference a package installer target that a lower-privileged app could not directly invoke.
Because AccountManagerService runs with system-level privileges, any intent it launches inherits that trust context. An attacker crafts an intent that survives the flawed check and directs the privileged service to install an application chosen by the attacker. The absence of a user interaction requirement removes the last safeguard that normally gates package installation on Android.
Root Cause
The root cause is improper resolution of intent targets during the security check in checkKeyIntent. The method's logic did not consistently account for intents that resolve to package installer activities under privileged conditions. Google's fix in commit e8a53246607b52b15269f97aef9ba7e928ba2473 tightens intent target verification to prevent this class confusion.
Attack Vector
A malicious application already installed on the device targets AccountManagerService by supplying a crafted intent through the account management API surface. The service treats the intent as legitimate and forwards it with system privileges, resulting in silent installation of an attacker-controlled APK. No permissions beyond those available to a standard third-party app are required, and no prompt is shown to the user.
See the Google source commit for the corrected validation logic.
Detection Methods for CVE-2024-40676
Indicators of Compromise
- Installation of applications outside of user-initiated flows or approved MDM channels.
- PackageInstaller activity launched with AccountManagerService as the calling identity in system logs.
- Newly registered account authenticators followed shortly by unexpected package installs.
- Devices running Android 12 through 15 without the October 2024 security patch level.
Detection Strategies
- Audit installed application inventories via Mobile Device Management (MDM) telemetry and flag packages not sourced from approved stores.
- Correlate account authenticator registration events with subsequent PackageManager install actions on the same device.
- Monitor Android security patch levels across the fleet and alert on devices below 2024-10-01.
Monitoring Recommendations
- Ingest MDM and Android Enterprise compliance events into a centralized data lake for cross-device correlation.
- Track application reputation and hash telemetry to identify unknown or unsigned packages after install.
- Alert when devices remain unpatched beyond a defined SLA following Google's monthly bulletin release.
How to Mitigate CVE-2024-40676
Immediate Actions Required
- Apply the Android October 2024 security patch level (2024-10-01) or later on all managed devices.
- Enforce MDM policies that block installation from unknown sources and require Google Play Protect.
- Remove untrusted third-party applications, particularly those requesting account authenticator capabilities.
Patch Information
Google released the fix in the Android Security Bulletin October 2024. The corresponding AOSP change is available at Google Source commit e8a5324. Device manufacturers ship the fix through their respective firmware updates aligned to Android versions 12, 12.1, 13, 14, and 15.
Workarounds
- Restrict device provisioning to fully managed profiles that disable installation of unverified authenticators.
- Disable Install unknown apps for all user profiles through MDM configuration until patches land.
- Isolate unpatched devices from sensitive corporate resources using conditional access policies.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output on patched devices: 2024-10-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
