Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-21237 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Google Android. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 17th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-21237 is a local information disclosure vulnerability in Android 13 that stems from insufficient or misleading UI handling in the applyRemoteView method of NotificationContentInflater.java. The flaw allows a foreground service notification to be hidden, which can conceal the presence of an active service from the user. The issue carries a CVSS score of 5.5 and is tracked under Android ID A-251586912.
A local attacker with low privileges can exploit the weakness without user interaction or additional execution rights. By triggering the condition, the attacker can suppress visibility of the foreground service notification, thereby obtaining information about running services that would otherwise be disclosed to the device user.
The June 2023 Pixel security bulletin addresses the flaw as part of the monthly Android update process. The vulnerability also appears in CISA’s catalog of known exploited vulnerabilities. Its EPSS score rose from a low baseline to a peak of 0.0718 on 2024-11-11 before receding, indicating that exploitation interest increased well after initial disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25405
Vulnerability Data
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
more
AndroidVersions: Android-13Android ID: A-251586912
- CWE(s)
- KEV Date Added
- 05 March 2024
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.
Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.
Prevents unauthorized exposure of sensitive information by prohibiting untrusted external systems from processing or storing it.
By enforcing authorization matching prior to sharing, the control reduces the risk of exposing sensitive information to unauthorized actors.
Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.
Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.
Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.
Retaining and monitoring training records confirms personnel have completed privacy and security awareness training on handling sensitive data, reducing the chance of unauthorized exposure due to lack of knowledge.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing classification and other controls; per the owner's explicit rule on labelling and similar dependency-style clauses, this does not itself prevent exposure (CWE-200) unless access/DLP/etc. act on it.
Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.
A.5.12 only defines and communicates a classification scheme so that protection needs can be understood; per the owner's explicit rule, labeling/classification does not itself prevent exposure and requires other controls (e.g. access enforcement) to act on it.
By requiring classification labels and metadata on all information assets, the control makes it harder for sensitive data to be inadvertently exposed because downstream systems and users can recognize and enforce handling rules based on those labels.
Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.
Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.