CVE-2024-43093: Android Framework Privilege Escalation Vulnerability

High severity, CVSS 7.3. Actively exploited: in CISA KEV since 2024-11-07. EPSS: 0.7% chance of exploitation in the next 30 days.

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

• Google Android: version 12.0 only; version 12.1 only; version 13.0 only; version 14.0 only; version 15.0 only

Published 2024-11-13. Last modified 2026-06-17.