CVE-2023-21269

Summary

CVE-2023-21269 is a vulnerability affecting the startActivityInner function in ActivityStarter.java. An attacker can bypass the Bounded Application Lifecycle (BAL) mechanism, enabling them to launch an activity into Picture-in-Picture (PiP) mode from the background. This escalation of privilege does not require any additional execution privileges or user interaction for exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.