CVE-2024-43088 Overview
CVE-2024-43088 is a local privilege escalation vulnerability in the Android Settings application. The flaw resides in multiple functions within AppInfoBase.java and stems from a missing permission check [CWE-862]. An authenticated local attacker can manipulate app permission settings that belong to another user on the same device. Exploitation crosses user boundaries and requires no user interaction or additional execution privileges. Google addressed the issue in the November 2024 Android Security Bulletin. The vulnerability affects Android versions 12.0, 12.1, 13.0, 14.0, and 15.0.
Critical Impact
A local application with standard privileges can alter permission grants for apps owned by other device users, breaking Android's multi-user isolation model.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2024-11-01 - Fix published in the Android Security Bulletin November 2024
- 2024-11-13 - CVE-2024-43088 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43088
Vulnerability Analysis
The vulnerability exists in AppInfoBase.java, a base class used by the Android Settings application to manage per-application configuration screens. Multiple functions in this class operate on package and permission state without verifying that the caller is authorized to act on the target user's data. Android supports multiple user profiles on a single device, and the platform relies on explicit permission checks to prevent one user context from modifying another. The missing checks let a local app running as one user reach permission-related operations that should be restricted to the owning user. This constitutes a horizontal privilege escalation across the Android multi-user boundary [CWE-862].
Root Cause
The root cause is a missing authorization check in AppInfoBase.java. The affected functions accept a target user identifier and act on app permission state without validating that the calling process holds the required cross-user permission such as INTERACT_ACROSS_USERS_FULL. The upstream patch adds the missing enforcement in the Settings package, as shown in the Android Settings code update.
Attack Vector
Exploitation requires local access with low privileges, typically a malicious or compromised app installed under one user profile. The attacker invokes the vulnerable code paths in the Settings component and supplies a user identifier that targets a different profile on the device. Because no user interaction is required, the manipulation can occur silently in the background. The attacker can toggle sensitive runtime permissions belonging to apps installed for another user, enabling downstream data access or interference with victim workloads.
No verified public proof-of-concept exploit is available. Refer to the Android Settings patch for the specific functions that received the added permission checks.
Detection Methods for CVE-2024-43088
Indicators of Compromise
- Unexpected changes to runtime permission grants for apps in secondary user profiles without user-initiated Settings activity.
- Applications launching cross-user Settings intents targeting permission management surfaces.
- Devices running Android 12 through 15 without the November 2024 security patch level applied.
Detection Strategies
- Inventory Android endpoints and flag any device whose reported security patch level predates 2024-11-01.
- Review Mobile Device Management (MDM) telemetry for apps requesting or invoking INTERACT_ACROSS_USERS related APIs outside expected system components.
- Audit installed applications on multi-user devices for unusual interaction with the Settings package com.android.settings.
Monitoring Recommendations
- Enroll Android devices in an MDM that reports monthly security patch levels and alerts on non-compliance.
- Monitor permission-state drift on managed profiles and correlate changes with the app or user that initiated them.
- Track newly installed third-party applications on devices that host multiple user profiles or work profiles.
How to Mitigate CVE-2024-43088
Immediate Actions Required
- Apply the Android security patch level 2024-11-01 or later on all affected devices.
- Prioritize devices in shared-use or multi-user deployments, including kiosk, family, and Bring Your Own Device (BYOD) scenarios.
- Restrict installation of untrusted applications on managed Android fleets via MDM policy.
Patch Information
Google published the fix in the Android Security Bulletin November 2024. The corresponding source change to the Settings component is available in the AOSP Settings commit, which introduces the missing permission enforcement in AppInfoBase.java. Original equipment manufacturers (OEMs) ship the fix in device-specific updates that report patch level 2024-11-01 or higher.
Workarounds
- Avoid provisioning multiple user profiles on unpatched devices to reduce cross-user attack surface.
- Limit sideloading and require app installations through vetted enterprise app catalogs.
- Remove or disable non-essential third-party applications on devices that cannot be immediately updated.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-11-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
