Cyber Resilience

CVE-2023-44126

Google Android 8.0 – 13.0

Published
27 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 3.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0012 2th percentile
Risk Priority 28 floored blend · peak EPSS

Summary

CVE-2023-44126 is a low-severity Improper Verification of Intent by Broadcast Receiver (CWE-925) vulnerability in Google Android. Its CVSS base score is 3.6 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Inter-Process Communication (T1559); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states,…

more

durations, called numbers, contacts info, etc.

CWE(s)
CWE-925NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1559 Inter-Process Communication Execution
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-44121Same product: Google Android
CVE-2023-44123Same product: Google Android
CVE-2023-44125Same product: Google Android
CVE-2023-44127Same product: Google Android
CVE-2025-9675Same product: Google Android
CVE-2025-9674Same product: Google Android
CVE-2025-9695Same product: Google Android
CVE-2025-9677Same product: Google Android
CVE-2026-33173Shared CWE-925
CVE-2024-10576Shared CWE-925

Affected Assets

google
android
8.0 — 13.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure development practices include explicit sender verification for broadcast receivers.

PR.AA-03 mostly match
prevents

Verifying sender identity directly prevents unauthorized broadcast Intents.

PR.AA-04 mostly match
prevents

Verifying identity assertions implements the missing authorization check for received Intents.

PR.AA-05 mostly match
prevents

Enforcing authorization policy for the receiver mitigates the improper verification flaw.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing intent verification but does not prevent the weakness by itself.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate intent verification for broadcast receivers.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include proper component authorization and input validation.

A.8.28 Secure coding partial match
prevents

Secure coding practices directly address proper intent verification in broadcast receivers.

References