CVE-2024-43087: Android Privilege Escalation Vulnerability

CVE-2024-43087 Overview

CVE-2024-43087 is a local privilege escalation vulnerability in Google Android. The flaw exists in the getInstalledAccessibilityPreferences method of AccessibilitySettings.java. A logic error allows an enabled accessibility service to be hidden from the accessibility service settings list. This concealment enables a malicious application to retain accessibility privileges without appearing in the standard user-facing settings view. Exploitation requires user interaction but no additional execution privileges. The vulnerability affects Android versions 12 through 15 and was addressed in the November 2024 Android Security Bulletin.

Critical Impact
A malicious application can hide an enabled accessibility service from settings, retaining elevated capabilities while evading user detection and enabling local privilege escalation.

Affected Products

Google Android 12.0 and 12.1
Google Android 13.0 and 14.0
Google Android 15.0

Discovery Timeline

2024-11-13 - CVE-2024-43087 published to the National Vulnerability Database (NVD)
2024-11-01 - Google addresses the issue in the Android Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43087

Vulnerability Analysis

The vulnerability resides in the Android Settings application, specifically in AccessibilitySettings.java. The getInstalledAccessibilityPreferences method is responsible for enumerating and displaying installed accessibility services to the user. A logic error in this method allows a crafted accessibility service to be omitted from the rendered preference list while remaining enabled at the system level.

Accessibility services in Android hold powerful capabilities. They can observe UI events, read on-screen content, inject gestures, and interact with other applications. Hiding such a service from settings undermines the primary user control that governs these capabilities. The classification maps to Missing Authorization [CWE-862].

Root Cause

The root cause is a logic error in how AccessibilitySettings.java filters or iterates installed accessibility services during preference construction. Under specific conditions, an enabled service is excluded from the displayed list even though the system continues to invoke it. This decoupling between enforcement state and visible state creates a persistence and concealment primitive.

Attack Vector

The attack vector is local and requires user interaction. A user must first install a malicious application and grant it accessibility permissions through the standard consent flow. Once enabled, the application leverages the logic flaw so that its accessibility service no longer appears in the accessibility settings screen. The user cannot easily disable the service through the expected UI path. The service continues to observe input events and screen contents, enabling credential capture, overlay attacks, and further privilege escalation actions typical of accessibility-abusing malware.

Refer to the Android Settings commit for the code-level fix and the Android Security Bulletin November 2024 for the official advisory.

Detection Methods for CVE-2024-43087

Indicators of Compromise

Enabled accessibility services present in system state but absent from the Accessibility settings preference list.
Applications requesting BIND_ACCESSIBILITY_SERVICE shortly after install without a clear functional justification.
Discrepancy between settings get secure enabled_accessibility_services output and the services shown in the UI.

Detection Strategies

Enumerate enabled accessibility services programmatically via AccessibilityManager.getEnabledAccessibilityServiceList and compare against services surfaced in the Settings UI.
Inventory installed applications that declare accessibility service components in their manifest and correlate with recent install events.
Flag mobile applications sideloaded from outside Google Play that request accessibility privileges during onboarding.

Monitoring Recommendations

Monitor mobile fleet devices for build fingerprints predating the November 2024 security patch level.
Alert on accessibility permission grants on managed Android devices through MDM or UEM telemetry.
Review Android security patch level compliance across Android 12, 13, 14, and 15 endpoints on a recurring cadence.

How to Mitigate CVE-2024-43087

Immediate Actions Required

Apply the November 2024 Android security patch level (2024-11-01 or later) to all affected devices.
Audit installed applications with accessibility permissions and remove any that are unrecognized or unnecessary.
Restrict installation of applications from unknown sources on managed devices through MDM policy.

Patch Information

Google released a fix in the Android Settings repository commit 6253b87704bb097ad9963941bdddf3b86906a73e. The patch is included in the November 2024 Android Security Bulletin. Device manufacturers distribute the fix as part of their monthly security update rollouts. Confirm the patch level under Settings → About phone → Android security update.

Workarounds

Disable accessibility services from the command line using adb shell settings put secure enabled_accessibility_services "" when a hidden service is suspected.
Uninstall recently installed applications that requested accessibility permissions if the device cannot yet receive the patch.
Enforce Google Play Protect and application allow-listing through enterprise mobility management to reduce the risk of installing malicious accessibility services.

bash

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch

# List enabled accessibility services (compare against Settings UI)
adb shell settings get secure enabled_accessibility_services

# Clear enabled accessibility services if a hidden service is suspected
adb shell settings put secure enabled_accessibility_services ""