CVE-2023-0460

The CVE-2023-0460 entry describes a vulnerability in YouTube Embedded 1.2 SDK: after binding to the YouTube Main App, the SDK creates a remote context with Context.CONTEXT_INCLUDE_CODE and Context.CONTEXT_IGNORE_SECURITY, enabling the client app to load code via the Main App’s ClassLoader. The is...

CVE-2023-0460: Use of Externally-Controlled Input to Select Classes or Code

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXTINCLUDECODE | Context.CONTEXTIGNORESECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s...