CVSS 3.1 Score 5.5 of 10 (medium)


Published Jul 13, 2023
Updated: Jul 20, 2023
CWE ID 346


CVE-2023-21260 is a cyber vulnerability that affects several products including bQe5zt, tzDcWF, sYyJEm, sYyJEl, fWGaF5, s23HS_, mmOpcJ, and nn8kgA. The vulnerability allows a malicious application to embed a long service label in the notification access permission dialog box, which can overflow the original user prompt and potentially display misleading information as a system message for user confirmation. The vulnerability has a risk score of 26 and is categorized as "MEDIUM" in terms of severity. It requires user interaction and has a low attack complexity. While it does not impact confidentiality, it has a high integrity impact. The potential danger it poses to an organization is the possibility of users being tricked into confirming system messages that are actually from malicious applications. No specific remediation steps or mitigation strategies are provided in the information provided.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-21260 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options