{"id":"ASB-A-261036568","details":"In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-261036568","CVE-2023-21105"],"modified":"2026-04-28T15:17:37.552933Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d06f0a83dec0f6ba1b4f8543733ef50003193c45"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/2a08fce4ebcc156efd3744ed19310815c1120b1c","signature_version":"v1","id":"ASB-A-261036568-2cedbf94","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"signature_type":"Line","digest":{"line_hashes":["253726217667786760008791040528132999656","165167302911885179610450896563829207823","308198263087350105219476252789194270748","33148234405229051030539775887061536342","201306625178986713830207582548032348741","64626392253400362784024705491591654332","211966680561740497663714364541390396657","116153715281298713921740752927747948301","29184445118983394318225779446664608360","115750373127915952869675036398917464525","326650116780486453560701669483210725806","236700874485000914452409146321181107154","310698022803936998611094094720741513342","119038689631925699356694708896154400916","217283487424805603317170886823554103492","95969329680756161589316170143870448628","259070882552151056206184815966693850678","88912497356020192797924013533262549676","229514256451205907132793163232077046191","261032593118902846775410064039241912448","39576133507403248033081898993184736915","139767485848797280636432058604744442565","165279467349875780587234856267300500637","174460412890091727653647537449447150126","246340357046729087773355927381921432107","92110331819432746662594647684344581925","76032597784933121096796574793930000095","130865442130004600818944995883347485051","179475362227689087644960463271347172283","83366769743593306496754744198464650022"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2a08fce4ebcc156efd3744ed19310815c1120b1c","signature_version":"v1","id":"ASB-A-261036568-6eb89fbd","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayImageContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"264222624834481844436079774627810762778","length":1907}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2a08fce4ebcc156efd3744ed19310815c1120b1c","signature_version":"v1","id":"ASB-A-261036568-84373d6b","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayTextContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"154106042623120946850607109636437335418","length":1317}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2a08fce4ebcc156efd3744ed19310815c1120b1c","signature_version":"v1","id":"ASB-A-261036568-85e5efed","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayFileContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"20520372287395268877369801923921441654","length":1523}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2a08fce4ebcc156efd3744ed19310815c1120b1c"],"severity":"High","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-261036568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-06-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/3062b80fb28014a7482d5fa8b2a5c852134a5845","signature_version":"v1","id":"ASB-A-261036568-11e71ceb","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"signature_type":"Line","digest":{"line_hashes":["72676619473570312338203408579459634006","279118738397569944925485559297762383710","253069371952622863841175709163592283731","90505955476097507459160713676842886738","101607602290044009287384226133798139799","29184445118983394318225779446664608360","115750373127915952869675036398917464525","326650116780486453560701669483210725806","236700874485000914452409146321181107154","249465837092934972216219783017613178809","109962230902670873959883426227661376359","24755993164753130054758367243104706440","326627262522977312872328903859680589951","122299229796650537733704690352280622000","88912497356020192797924013533262549676","229514256451205907132793163232077046191","261032593118902846775410064039241912448","107671859472151350138955221757669390837","104624233187743576306487380385516631443","229882986999134343761249696115303910731","16104477654381492871598930470273699266","17891085158116565178803411736752737802","77344918543907350838286617376646018070","1675914478338312951510863546296340483","130865442130004600818944995883347485051","179475362227689087644960463271347172283","83366769743593306496754744198464650022"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/3062b80fb28014a7482d5fa8b2a5c852134a5845","signature_version":"v1","id":"ASB-A-261036568-2acf9479","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayImageContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"168480907997865735293421016998304914791","length":1483}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/3062b80fb28014a7482d5fa8b2a5c852134a5845","signature_version":"v1","id":"ASB-A-261036568-36581d52","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayTextContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"313410474153800703818554734132834865285","length":1293}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/3062b80fb28014a7482d5fa8b2a5c852134a5845","signature_version":"v1","id":"ASB-A-261036568-a328ab6c","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayFileContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"242379224209021669729012863555297129034","length":1334}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3062b80fb28014a7482d5fa8b2a5c852134a5845"],"severity":"High","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-261036568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/e66544a48fca830dc9a12efcf8ce828c3df4cba2","signature_version":"v1","id":"ASB-A-261036568-32fe74b6","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"signature_type":"Line","digest":{"line_hashes":["72676619473570312338203408579459634006","279118738397569944925485559297762383710","253069371952622863841175709163592283731","90505955476097507459160713676842886738","101607602290044009287384226133798139799","29184445118983394318225779446664608360","115750373127915952869675036398917464525","326650116780486453560701669483210725806","236700874485000914452409146321181107154","2475584891144383762654666340009100521","54629919407639739298443381694112607715","49560251725040251662533853590902787283","129878659345110227341270293465588378288","122299229796650537733704690352280622000","88912497356020192797924013533262549676","229514256451205907132793163232077046191","261032593118902846775410064039241912448","107671859472151350138955221757669390837","104624233187743576306487380385516631443","229882986999134343761249696115303910731","16104477654381492871598930470273699266","17891085158116565178803411736752737802","77344918543907350838286617376646018070","1675914478338312951510863546296340483","130865442130004600818944995883347485051","179475362227689087644960463271347172283","83366769743593306496754744198464650022"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e66544a48fca830dc9a12efcf8ce828c3df4cba2","signature_version":"v1","id":"ASB-A-261036568-847cf0e9","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayFileContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"242379224209021669729012863555297129034","length":1334}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e66544a48fca830dc9a12efcf8ce828c3df4cba2","signature_version":"v1","id":"ASB-A-261036568-b01237da","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayImageContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"146855786625821132407457593341786259978","length":1851}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e66544a48fca830dc9a12efcf8ce828c3df4cba2","signature_version":"v1","id":"ASB-A-261036568-cfa4af85","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayTextContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"313410474153800703818554734132834865285","length":1293}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e66544a48fca830dc9a12efcf8ce828c3df4cba2"],"severity":"High","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-261036568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/fa83e125d14e458545086d16f2e7d1051812dabc","signature_version":"v1","id":"ASB-A-261036568-5e93a784","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayTextContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"154106042623120946850607109636437335418","length":1317}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/fa83e125d14e458545086d16f2e7d1051812dabc","signature_version":"v1","id":"ASB-A-261036568-6f476f8e","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayImageContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"70208145209126104427639452525149750083","length":1875}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/fa83e125d14e458545086d16f2e7d1051812dabc","signature_version":"v1","id":"ASB-A-261036568-b88ce3a2","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java","function":"displayFileContentPreview"},"deprecated":false,"signature_type":"Function","digest":{"function_hash":"86358525133426936273093614594678328156","length":1491}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/fa83e125d14e458545086d16f2e7d1051812dabc","signature_version":"v1","id":"ASB-A-261036568-d320df11","target":{"file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"signature_type":"Line","digest":{"line_hashes":["317175481891830028875890499286253248406","293354176801787657407705197700276615103","36688713616265519136584952290530122639","305509367021691055189845973402872054971","116153715281298713921740752927747948301","29184445118983394318225779446664608360","115750373127915952869675036398917464525","326650116780486453560701669483210725806","236700874485000914452409146321181107154","2475584891144383762654666340009100521","54629919407639739298443381694112607715","49560251725040251662533853590902787283","129878659345110227341270293465588378288","122299229796650537733704690352280622000","88912497356020192797924013533262549676","229514256451205907132793163232077046191","261032593118902846775410064039241912448","221258311919769997448031507497479780756","104624233187743576306487380385516631443","229882986999134343761249696115303910731","16104477654381492871598930470273699266","17891085158116565178803411736752737802","77344918543907350838286617376646018070","1675914478338312951510863546296340483","130865442130004600818944995883347485051","179475362227689087644960463271347172283","83366769743593306496754744198464650022"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fa83e125d14e458545086d16f2e7d1051812dabc"],"severity":"High","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-261036568.json"}}],"schema_version":"1.7.5"}