CVE-2023-20971

7.8 highEPSS 0.1%

High (7.8) in google android. EPSS 0.1% chance of exploitation in the next 30 days.

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2023-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:android

References

https://android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131
https://source.android.com/security/bulletin/2024-08-01
https://source.android.com/security/bulletin/pixel/2023-06-01

Check your stack JSON