CVE-2023-21286

CVE-2023-21286 affects Android’s RemoteViews.java, specifically the visitUris path. The issue is described as a missing permission check that could allow a local attacker to reveal images across users, resulting in local escalation of privilege without requiring extra execution privileges. The ex...

CVE-2023-21286

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...