CVE-2024-43093

high

Description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093

https://securityaffairs.com/176337/hacking/google-fixed-two-actively-exploited-android-zero-days.html

https://www.securityweek.com/google-patches-pair-of-exploited-vulnerabilities-in-android/

https://www.bleepingcomputer.com/news/security/google-fixes-android-zero-days-exploited-in-targeted-attacks/

https://thehackernews.com/2025/03/googles-march-2025-android-security.html

https://cyberscoop.com/android-security-update-march-2025/

https://securityaffairs.com/173812/hacking/google-android-kernel-zero-day-flaw.html

https://www.bleepingcomputer.com/news/security/google-fixes-android-kernel-zero-day-exploited-in-attacks/

https://thehackernews.com/2024/11/google-warns-of-actively-exploited-cve.html

https://securityaffairs.com/170581/uncategorized/cve-2024-43093-android-flaw-actively-exploited.html

https://thehackernews.com/2024/06/google-warns-of-pixel-firmware-security.html

https://source.android.com/security/bulletin/2025-03-01

https://source.android.com/docs/security/bulletin/2024-11-01

https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10

Details

Source: Mitre, NVD

Published: 2024-11-13

Updated: 2025-10-23

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.3

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00627