Guide-and-theoretical-code-for-CVE-2023-35674

CVE-2023-35674 的指南与理论代码 CVE-2023-35674 的指南和理论代码 由于 Android 超出了我的技能范围，请将我这里的内容视为我个人视角下关于如何利用此 CVE 的高层概述。代码片段只是骨架，请帮帮忙 : 所以，首先你不能仅靠 CVE-2023-35674 进行利用。为什么？因为 CVE-2023-35674 仅仅是因一个逻辑错误而允许你启动后台活动。因此，本质上你会利用此 CVE 在后台启动一个应用，并使用像 CVE-2021-0307 这样的漏洞进行权限提升。一句忠告：要完全利用这两个漏洞（即利用这条漏洞链），唯一的方法是你的 Android 必须是...

CVE-2023-35674

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-35674

The CVE-2023-35674 issue affects the Android Framework, specifically an onCreate path in WindowState.java that can launch a background activity due to a logic error. This enables local elevation of privilege without extra execution privileges and without user interaction. The Android Security Bul...

CVE-2023-35674

creationtimestamp| type| source ---|---|--- 2023-09-06 16:05:21+00:00| exploited| https://t.me/thehackernews/3835 2023-09-06 17:11:46+00:00| seen| Telegram/63J2pVQJBaIknmjZGAIHn5x98Q9jXCZX7v9RgXfkNAcIQ 2023-09-06 18:31:04+00:00| seen| https://t.me/KomunitiSiber/752 2023-09-07 09:36:42+00:00| seen...

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

Google has rolled out monthly security patches for Android to address a number of flaws, including a zero-day bug that it said may have been exploited in the wild. Tracked as CVE-2023-35674, the high-severity vulnerability is described as a case of privilege escalation impacting the Android...