{"id":"ASB-A-264029851","details":"In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-264029851","CVE-2023-35674"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-09-01"}]}],"versions":["13-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["185024076188985592697592657200111398921","255133638716784176650648678599829280208","221334879092567230297954167268086863808","104232059452926191079370652715497707313","17577955838972545061065088638555892591","340092115117716892634110623799607735440","3955563167083734528194287429410886808","142705210300934374365406619340716582477"],"threshold":0.9},"id":"ASB-A-264029851-45f4d0bb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"onSurfaceShownChanged"},"deprecated":false,"digest":{"function_hash":"40944750017110693121515483246201261836","length":461},"id":"ASB-A-264029851-faa2b792","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/050005fd2f19a5bc2d7a1c7786b4ded1945fb807"],"severity":"High","spl":"2023-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-264029851.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-09-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["97260578544918248991463186177328886441","119343172529379441452430847437454128779","215138338139349316760125805301963934604","48223376524673286516200772446024508334","172239829722657991414987393139096621482","334997900967039618802761655709050408035","168345275794499243708915044743680084759","108738882280443592871400280875675509294","29356192979170191859971992315528918007","210158276655113248346893409686026237450","30214045548178003426689801848769202821"],"threshold":0.9},"id":"ASB-A-264029851-1ae9f4f4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"isNonToastOrStartingOrPrivatePresentation"},"deprecated":false,"digest":{"length":151,"function_hash":"282644488101311748694964662225614431131"},"id":"ASB-A-264029851-c22b6fb2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/07019d9060d31d12b1d2cbb10635dfaa1b36c95c"],"severity":"High","spl":"2023-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-264029851.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-09-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2023-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-264029851-09170f03","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"onSurfaceShownChanged"},"deprecated":false,"digest":{"function_hash":"168749629929425575047631186685372659187","length":566}},{"deprecated":false,"digest":{"line_hashes":["197372349787029204334728444664611643510","309997718070563876267114674274505731218","221334879092567230297954167268086863808","104232059452926191079370652715497707313","113282503497021672669107396203861564138","4565792421663824132010776155881907794","3955563167083734528194287429410886808","142705210300934374365406619340716582477"],"threshold":0.9},"id":"ASB-A-264029851-ee825087","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf60a0c6f153a55714d4879bb6cf5b239381a22a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-264029851.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-09-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","spl":"2023-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"onSurfaceShownChanged"},"deprecated":false,"digest":{"length":573,"function_hash":"333509893200142190169172937928280843382"},"id":"ASB-A-264029851-54d4deca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de"},{"id":"ASB-A-264029851-87fed0b0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["197372349787029204334728444664611643510","309997718070563876267114674274505731218","221334879092567230297954167268086863808","104232059452926191079370652715497707313","195434201744059629031553280034407819621","4565792421663824132010776155881907794","3955563167083734528194287429410886808","142705210300934374365406619340716582477"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/42557cb5710527a3ed1a6683d2dad82777ba34de"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-264029851.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-09-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"18693669996602847281805167538283739496","length":426},"id":"ASB-A-264029851-61afed30","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"onSurfaceShownChanged"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["197372349787029204334728444664611643510","309997718070563876267114674274505731218","221334879092567230297954167268086863808","104232059452926191079370652715497707313","17577955838972545061065088638555892591","340092115117716892634110623799607735440","3955563167083734528194287429410886808","142705210300934374365406619340716582477"]},"id":"ASB-A-264029851-ccc1de09","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5bf9607bec3f1224158cfcff7dd91ac558b46c0f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-264029851.json"}}],"schema_version":"1.9.0"}