Actively exploited in the wild
Android Framework Privilege Escalation Vulnerability
Android - Framework · Listed in the CISA KEV since 2023-09-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-35674
HighCVSS 7.8KEVSummary
In onCreate of WindowState.java, there is a logic error that allows launching a background activity. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
A local attacker could gain elevated privileges, potentially leading to device compromise or access to other apps' data.
Recommendation
Update Android to the latest version containing the fix for this issue. Restrict installation of untrusted applications on devices.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2026-28606Critical
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2025-48572HighActively exploited
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2024-32896HighActively exploited
The vulnerability is due to a logic error in the code that allows bypassing security controls. It could lead to local escalation of privilege with no additional execution privileges needed, but user interaction is required for exploitation.
- CVE-2023-20963HighActively exploited
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-58744High
In multiple locations, improper input validation may lead to privilege escalation. Exploitation requires local access and needs no user interaction or additional execution privileges.
- CVE-2026-58724High
In multiple locations, a race condition leads to a use-after-free. This may result in local privilege escalation with System execution privileges required.
Original NVD description (English source)
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.