CVE-2023-21237

Android Pixel devices are vulnerable to information disclosure via misleading UI that hides foreground service notifications.

This local-only vulnerability allows attackers to bypass notification visibility controls to expose sensitive data, posing a risk to DIB organizations relying on Android endpoints for sensitive data handling. While not an RCE, the information disclosure could facilitate further attacks or data exfiltration if combined with other vulnerabilities, necessitating immediate patching and UI hardening.

Shame score — A local UI vulnerability that enables information disclosure rather than remote code execution, with no evidence of active exploitation in the wild.