CVE-2023-21092

In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242040055

• CWE-20

• https://source.android.com/security/bulletin/2023-04-01Patch, Vendor Advisory
• https://source.android.com/security/bulletin/2023-04-01Patch, Vendor Advisory

Published

Apr 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-21087In PreferencesHelper.java, an uncaught exception may cause t…5.5
• CVE-2023-21088In deliverOnFlushComplete of LocationProviderManager.java, t…7.8
• CVE-2023-21089In startInstrumentation of ActivityManagerService.java, ther…7.8
• CVE-2023-2109Cross-site Scripting (XSS) - DOM in GitHub repository chatwo…6.1
• CVE-2023-21090In parseUsesPermission of ParsingPackageUtils.java, there is…5
• CVE-2023-21091In canDisplayLocalUi of AppLocalePickerActivity.java, there …5.5
• CVE-2023-21093In extractRelativePath of FileUtils.java, there is a possibl…7.8
• CVE-2023-21094In sanitize of LayerState.cpp, there is a possible way to ta…7.8
• CVE-2023-21095In canStartSystemGesture of RecentsAnimationDeviceState.java…4.7
• CVE-2023-21096In OnWakelockReleased of attribution_processor.cc, there is …9.8
• CVE-2023-21097In toUriInner of Intent.java, there is a possible way to lau…7.8
• CVE-2023-21098In multiple functions of AccountManagerService.java, there i…7.8