LiveActive security incident?Get immediate response
CVE Record

CVE-2023-20918: In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a...

In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-20918 is an Android elevation-of-privilege issue in ActivityOptions handling for pending intent launch flags. A malicious app could potentially cause Android to perform privileged behavior on its behalf. The source says exploitation does not require user interaction or extra execution privileges.

Executive priority

Treat this as a mobile fleet hygiene issue with moderate urgency. It is privilege escalation without user interaction, but the supplied evidence does not show active exploitation or critical severity.

Technical view

The issue is described in getPendingIntentLaunchFlags of ActivityOptions.java as a confused deputy elevation of privilege affecting Android 11, 12, 12L, and 13. Public references point to AOSP framework/base changes and the Android July 2023 security bulletin, but the supplied data does not include CVSS metrics.

Likely exposure

Organizations with unmanaged, outdated, or slow-to-update Android 11 through 13 devices are the most likely exposed. Risk is lower where devices receive current Android security patch levels through OEM or enterprise management.

Exploitation context

The provided sources state no user interaction and no additional execution privileges are needed. They do not show active exploitation, public exploit availability, or CISA KEV listing.

Researcher notes

Focus review on ActivityOptions pending intent launch flag handling and the referenced AOSP framework/base commits. The CWE-611 mapping appears unusual for this Android confused-deputy description, so validate classification before using it analytically.

Mitigation direction

  • Apply Android security updates from the July 2023 bulletin or later where available.
  • Prioritize Android 11, 12, 12L, and 13 devices in enterprise fleets.
  • Check OEM advisories for device-specific patch availability and rollout timing.
  • Restrict untrusted app installation on devices awaiting updates.
  • Use MDM inventory to identify unsupported or stale Android patch levels.

Validation and detection

  • Inventory Android OS versions and security patch levels across managed devices.
  • Confirm affected devices are updated beyond the July 2023 Android bulletin level.
  • Review OEM release notes for CVE-2023-20918 coverage.
  • Check EMM compliance reports for devices blocking required updates.
  • Monitor Android security bulletins for any revised severity or guidance.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-611: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-20918 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleAndroid13, 12L, 12, 11unaffected
Weakness

CWE details

CWE-611

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-611 · source CWE mapping

Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs