Android Framework Privilege Escalation Vulnerability

HIGH 7.8EXPLOITED (CISA KEV)CVE-2023-20963 · Published 24/03/2023 · updated 17/06/2026

Android Framework Privilege Escalation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/04/2023. Patch affected systems as an emergency.

In short

CVE-2023-20963 is a HIGH (CVSS 7.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 13/04/2023.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
Framework Android	Versions not published yet (product named by CISA KEV)

Description

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

References

source.android.com/security/bulletin/2023-03-01 · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2023-20963

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free