CVE-2023-45777

HIGH

Android - Local Privilege Escalation via AccountManagerService Parcel Mismatch

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2023-45777. PoCs published by michalbednarski, B-D-APL.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2023-45777, focusing on a patch in Android's AccountManagerService that addresses a deserialization vulnerability involving Intent objects in Bundles. The writeup explains the root cause, the role of LazyValue in Android's Parcel/Bundle hardening, and how the vulnerability could be exploited through side effects of unchecked deserialization.

Description

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Exploits (2)

nomisec WRITEUP 99 stars
by michalbednarski · poc
https://github.com/michalbednarski/TheLastBundleMismatch

This repository provides a detailed technical analysis of CVE-2023-45777, focusing on a patch in Android's AccountManagerService that addresses a deserialization vulnerability involving Intent objects in Bundles. The writeup explains the root cause, the role of LazyValue in Android's Parcel/Bundle hardening, and how the vulnerability could be exploited through side effects of unchecked deserialization.

Classification
Writeup 100%
Attack Type
Deserialization
Complexity
Complex
Reliability
Theoretical
Target: Android Framework (AccountManagerService)
No auth needed
Prerequisites: Access to a vulnerable Android device or emulator · Ability to craft malicious Bundles with Intent objects
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by B-D-APL · poc
https://github.com/B-D-APL/silver-succotash

The repository contains only GitHub template files and no actual exploit code or technical details related to CVE-2023-45777.

Classification
Stub 95%
Attack Type
Other
Complexity
N/a
Reliability
N/a
Target: N/A
No auth needed
devstral-2 · analyzed Apr 10, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 7.8
EPSS 0.0034
EPSS Percentile 26.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (2)
google/android 13.0
google/android 14.0
Published Dec 04, 2023
Tracked Since Feb 18, 2026