# CVE-2023-21237

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

- Page: https://www.vulneraibility.com/cve/CVE-2023-21237
- CVSS: 5.5
- Known exploited: yes, in CISA KEV since 2024-03-05; CISA due date 2024-03-26
- EPSS: 0.27% (percentile 18.6)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2024-03-05)
- Weakness: CWE-200
- Published: 2023-06-28

## Affected versions

- Android: affected Android-13

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://source.android.com/security/bulletin/pixel/2023-06-01
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21237

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.