December 2023: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 59 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r3 adds the fix for 28 CVEs: CVE-2023-40073, CVE-2023-40075, CVE-2023-40076, CVE-2023-40077, CVE-2023-40078, CVE-2023-40079, CVE-2023-40080, CVE-2023-40082, CVE-2023-40083, CVE-2023-40084, CVE-2023-40087, CVE-2023-40088, CVE-2023-40089, CVE-2023-40090, CVE-2023-40091, CVE-2023-40092, CVE-2023-40094, CVE-2023-40095, CVE-2023-40096, CVE-2023-40098, CVE-2023-40103, CVE-2023-45773, CVE-2023-45774, CVE-2023-45775, CVE-2023-45776, CVE-2023-45777, CVE-2023-45781, CVE-2023-45866.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

These fixes carry a different trace from the bulletin's commit (another bug id, no Bug line, a merge), and were matched by content. Similarity is the share of the reference's changed lines found in the commit.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 2 fixes in android-security-14.0.0_r3

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-40073 · platform/frameworks/base
  Notification.visitUris() now visits the MessagingStyle extras (EXTRA_MESSAGES, EXTRA_HISTORIC_MESSAGES, EXTRA_CONVERSATION_ICON) and the CallStyle extras (EXTRA_CALL_PERSON, call verification icon) whenever extras is non-null. Before the fix this happened only when isStyle(MessagingStyle.class) or isStyle(CallStyle.class) was true. The already-unconditional EXTRA_MESSAGING_PERSON visit is moved next to the other MessagingStyle extras.
• CVE-2023-40075 · platform/frameworks/base
  Moves the ensureShortcutCountBeforePush() call in ShortcutPackage from the push path (the method whose disabled-shortcut message references pushDynamicShortcuts()) into forceReplaceShortcutInner, right before saveShortcut(), to bound shortcuts published through addDynamicShortcuts.
• CVE-2023-40076 · platform/frameworks/base
  The Credential Manager service (CredentialManagerUi) now creates the PendingIntent for its UI with PendingIntent.getActivityAsUser bound to UserHandle.of(mUserId) instead of PendingIntent.getActivity, which takes no explicit user.
• CVE-2023-40077 · platform/frameworks/av
  Adds a std::mutex to MetaDataBase::MetaDataInternal and takes it in clear, remove, setData, findData, hasData, toString, dumpToLog and writeToParcel, so concurrent threads no longer race on the KeyedVector of items.
• CVE-2023-40078 · platform/packages/modules/Bluetooth
  Adds a check after the opus_decode() retry in a2dp_vendor_opus_decoder_decode_packet. If the retry fails, the packet is dropped. Before, the negative error code was turned into a huge unsigned frame length that was passed to the decode callback.
• CVE-2023-40079 · platform/frameworks/base
  ShortcutService now sends the client-supplied callback IntentSender with ActivityOptions that set MODE_BACKGROUND_ACTIVITY_START_DENIED, so the PendingIntent no longer benefits from system_server's background-activity-launch privilege.
• CVE-2023-40080 · platform/packages/modules/Bluetooth
  Adds MAX_SYNC_TRANSACTION checks on the index returned by the periodic-sync table lookups in system/stack/btm/btm_ble_gap.cc before it is used to address btm_ble_pa_sync_cb.p_sync[] and btm_ble_pa_sync_cb.sync_transfer[], across five functions.
• CVE-2023-40082 · platform/packages/modules/Virtualization
  pvmfw now generates a random 64-bit value and writes it into the guest device tree's /chosen/kaslr-seed property, so the template's constant placeholder (-1) is no longer passed to the guest.
• CVE-2023-40083 · platform/packages/modules/Bluetooth
  Adds a bounds check in parse_gap_data (system/main/shim/utils.cc). When a GAP data element's declared length is larger than the bytes left in the buffer, parsing now stops instead of copying past the end of raw_data.
• CVE-2023-40084 · platform/system/netd
  Replaces the netdutils::threadLaunch-started monitor thread in netd's MDnsSdListener::Monitor with a stored std::thread. A new Monitor destructor interrupts this thread by closing one end of the control socketpair and then joins it, so Monitor::run can no longer run on a destroyed Monitor instance.
• CVE-2023-40087 · platform/packages/modules/Bluetooth
  Bounds the sample loops in transcodeQ15ToFloat, transcodeQ23ToFloat and transcodeQ31ToFloat (system/btif/src/btif_avrcp_audio_track.cc) by the destination buffer length (trackHolder->bufferLength) and replaces the off-by-one `<=` loop condition, which ran one iteration past length/sampleSize.
• CVE-2023-40088 · platform/packages/modules/Bluetooth
  Adds `callbackEnv = NULL;` after `vm->DetachCurrentThread()` in the DISASSOCIATE_JVM branch of callback_thread_event in the Bluetooth AdapterService JNI. After the callback thread is detached, the code no longer keeps a dangling JNIEnv pointer.
• CVE-2023-40089 · platform/frameworks/base
  Makes DevicePolicyManager.getCredentialManagerPolicy() user-handle aware. The IDevicePolicyManager call now carries an explicit userId, the service looks up the profile/device owner for that user instead of the Binder caller's user, and cross-user queries require INTERACT_ACROSS_USERS.
• CVE-2023-40090 · platform/packages/modules/Bluetooth
  Replaces the plain memcmp used to compare the computed AES-CMAC with the received signature in BTM_BleVerifySignature with BoringSSL's CRYPTO_memcmp, which is hardened against timing side channels.
• CVE-2023-40091 · platform/frameworks/base
  The SHELL_COMMAND_TRANSACTION handler in incidentd's IncidentService::onTransact now reads the in/out/err file descriptors with Parcel::readUniqueFileDescriptor (which dups them) and hands owned fds to fdopen via release(), instead of fdopen'ing fds still owned by the Parcel.
• CVE-2023-40092 · platform/frameworks/base
  Adds a check in ShortcutService.verifyShortcutInfoPackage that the user ID embedded in a caller-supplied ShortcutInfo equals the user ID of the Binder calling UID, throwing SecurityException otherwise.
• CVE-2023-40094 · platform/frameworks/base
  Adds a CONTROL_KEYGUARD permission check to the IActivityTaskManager.keyguardGoingAway binder entry point in ActivityTaskManagerService so that callers without that permission can no longer signal that the keyguard is going away.
• CVE-2023-40095 · platform/frameworks/base
  The fix makes PendingIntentUtils.createDontSendToRestrictedAppsBundle explicitly call setPendingIntentBackgroundActivityLaunchAllowed(false) on the BroadcastOptions it builds. PendingIntents that system_server sends with these options (the commit title names requestGeofence) can no longer be used to bypass background activity launch restrictions.
• CVE-2023-40096 · platform/frameworks/av
  AudioPolicyService::OpRecordAudioMonitor now registers its AppOps watcher with AppOpsManager::WATCH_FOREGROUND_CHANGES only for apps that target SDK U or later, after an interim revert that removed the flag for all apps. For those apps, foreground and background transitions are watched, so background recording can be silenced.
• CVE-2023-40098 · platform/frameworks/base
  SystemUI's conversation notification guts now only requests pinning a People Space (priority conversation) widget when the notification's user is in the same profile group as the system user, so marking a conversation as priority on a secondary user no longer triggers the widget pin request.
• CVE-2023-40103 · platform/frameworks/base
  Two frameworks/base commits make AssetManager2 hold promoted (strong) ApkAssets references for the whole duration of a scoped "operation" instead of re-promoting weak pointers per access, and make the Java StringBlock/XmlBlock/AssetManager wrappers null out native pointers after destruction and reject calls on a gone native object.
• CVE-2023-45773 · platform/packages/modules/Bluetooth
  Adds MAX_SYNC_TRANSACTION sentinel checks before indexing the periodic-sync tables (p_sync[] and sync_transfer[]) in five functions of system/stack/btm/btm_ble_gap.cc, so a failed index lookup no longer leads to an out-of-bounds access.
• CVE-2023-45774 · platform/frameworks/base
  ShortcutService now checks, while validating an incoming shortcut, that the calling UID can grant read access to the content URI behind a URI-based shortcut icon (Icon.TYPE_URI / TYPE_URI_ADAPTIVE_BITMAP), using UriGrantsManagerInternal.checkGrantUriPermission.
• CVE-2023-45775 · platform/packages/modules/Bluetooth
  Adds length checks (size >= 2) on the StreamingAudioContext LTV value in LeAudioBroadcasterImpl::CreateAudioBroadcast before it is written with UINT16_TO_STREAM and read with STREAM_TO_UINT16, returning early on short values.
• CVE-2023-45776 · platform/packages/modules/Bluetooth
  Adds length checks in LeAudioBroadcasterImpl (system/bta/le_audio/broadcaster/broadcaster.cc) so that the 2-byte StreamingAudioContext LTV value from caller-supplied broadcast subgroup metadata is only read or written when the value vector holds at least 2 bytes.
• CVE-2023-45777 · platform/frameworks/base
  In AccountManagerService.checkKeyIntentParceledCorrectly, replaces the deprecated untyped Bundle.getParcelable(KEY_INTENT) read of the authenticator-supplied bundle with the typed getParcelable(KEY_INTENT, Intent.class).
• CVE-2023-45781 · platform/packages/modules/Bluetooth
  Adds a bounds check in parse_gap_data (system/main/shim/utils.cc). If a GAP data element's length byte points past the end of raw_data, parsing now stops instead of copying out of bounds.
• CVE-2023-45866 · platform/packages/modules/Bluetooth
  The Bluetooth BTM security manager (system/stack/btm/btm_sec.cc) now rejects remote-initiated access to L2CAP and RFCOMM services that require incoming authentication when the peer is authenticated through a temporary bond, returning BTM_FAILED_ON_SECURITY. Related commits stop forcing the authenticate bit for SM4 peers and start authentication whenever encryption is required.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).