CVE-2023-40130

https://wrlus.com/android-security/bindservice-error-handle/...

CVE-2023-0460: Use of Externally-Controlled Input to Select Classes or Code

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...