{"id":"PUB-A-238602879","details":"In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-238602879","CVE-2022-20512"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["87023234758636688518580279742977847492","156227951408008149834809767716402724201","139538904288499720733161739059871245162","17906862208350683992250854401296033418","18570516621411759979227798673153229010","62939044643125166266960321315167273467","325506342793831268866187749169094700697","128557412904820919273039029231580412176","53298215061424404130679366970089834771","237293726578278862743492198370101092423","338938134932563759249131400322763920224","25420170227652838024166694697780244688","88372360178374856683271211677692117338","290662778995779118785300837761397747970","132350304773521846314295717061613364331","328504435574437078211190151648417571967","122781516842314321148626743446737549504","214483010262324132343025915366814790676","52168654157603053583445468678094860297","12529517412027992795308357350496645327","43910844674588589681746577153810251861","328071507593102006017421473658828670766","167036411047712391975502344021954460322","276223985194962337881169963514332698391","60398313064302945078369980694065506932","198717170560423248128880402600788625734","5812219054698407678957203650405056987","15374866258333306775744673837346384118","319632001533401223903935507899340528659"],"threshold":0.9},"id":"PUB-A-238602879-32c625b9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10","target":{"file":"services/core/java/com/android/server/wm/Task.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10","target":{"file":"core/java/android/app/Activity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["306559393022413925382155773692320296384","238960534496907325979934580275291698422","169188590464448337574821319562833570629","78745171192634581654606904275711492068","53788038157245073677564316840809908521"]},"id":"PUB-A-238602879-3b26aeba","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1"},{"match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10","target":{"file":"core/java/android/app/ActivityClient.java"},"deprecated":false,"digest":{"line_hashes":["282781627699296836975327025386161346934","42094766961544345880972979640642786933","250550536400353281549849636313870821883","290482630999081124066155995341611557341","236854611551494729720537003077808950778","120524270434374463572634767311078181470","162774942616731393439321803859546688995","249567687540557912646933735048079729022"],"threshold":0.9},"id":"PUB-A-238602879-4c43d792"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10","target":{"function":"navigateUpTo","file":"core/java/android/app/Activity.java"},"deprecated":false,"digest":{"function_hash":"91395776182192251487408040872637904378","length":558},"id":"PUB-A-238602879-6431ec59","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/wm/Task.java","function":"navigateUpTo"},"deprecated":false,"digest":{"function_hash":"307238130757706282620781154472359191247","length":2999},"id":"PUB-A-238602879-8eb4c0c3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10"},{"match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43236168583164607272166184699747538749","112539726971416951003819936074542494816","11679931484379987831102043081266917436","96198931258405865349890283898157425465","247847563746743205079531358196549504093","211702326257149068260973419647808809405","128223971925101955697380962639458389835","70871824146377541733704190391174489597","119710023312408707206073918279139011674"]},"id":"PUB-A-238602879-8f426356"},{"target":{"function":"navigateUpTo","file":"services/core/java/com/android/server/wm/ActivityClientController.java"},"deprecated":false,"digest":{"function_hash":"206418071082596740030823545870001781072","length":439},"id":"PUB-A-238602879-f440e919","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-238602879.json"}}],"schema_version":"1.9.0"}