April 2024: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 8 | 8 | 0 | 0 | android-security-14.0.0_r7 |
| Android 15 (pre-release, 15-next) | 0 | 0 | 0 | 0 | none |
| Android 16 (pre-release, 16-next) | 0 | 0 | 0 | 0 | none |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 20 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.
android-security-14.0.0_r7 adds the fix for 5 CVEs: CVE-2023-21267, CVE-2024-23704, CVE-2024-23710, CVE-2024-23712, CVE-2024-23713.
Announced, with no public code
None this month.
Public before it was announced
The fixing commit was in a public security tag before the bulletin announced the CVE.
| CVE | Majors (tag where the fix is complete) | Public since | Days early |
|---|---|---|---|
| CVE-2024-0022 | 14 (r4) | 2024-01-03 | 89 |
| CVE-2024-0026 | 14 (r5) | 2024-02-05 | 56 |
| CVE-2024-0027 | 14 (r5) | 2024-02-05 | 56 |
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
No security tag this month.
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2023-21267 · platform/frameworks/base
Makes SystemUI's KeyguardViewMediator show (and refuse to hide) the keyguard when the current user is in lockdown, even if an app has externally disabled the keyguard. It also fixes LockPatternUtils.isUserInLockdown so that it still detects lockdown when other strong-auth flags are set. - CVE-2024-0022 · platform/frameworks/base
CompanionDeviceManagerService.requestNotificationAccess now passes the caller-supplied userId into checkCanCallNotificationApi/enforceCallerIsSystemOr instead of ignoring it. Per the commit message, this makes sure the calling user id matches the passed user id, so notification access can no longer be requested across users. - CVE-2024-0026 · platform/frameworks/base
SnoozeHelper.canSnooze now also counts the two persisted snoozed-notification maps against CONCURRENT_SNOOZE_LIMIT, and repostGroupSummary removes the reposted group summary from those persisted maps so they can no longer grow unbounded and cause a boot loop when serialized. - CVE-2024-0027 · platform/frameworks/base
SnoozeHelper.canSnooze now also counts the two persisted snoozed-notification maps against CONCURRENT_SNOOZE_LIMIT, and repostGroupSummary removes the group summary key from those persisted maps when the in-memory record is removed, bounding the snoozed-notification state that is serialized to disk. - CVE-2024-23704 · platform/packages/apps/Settings
WifiDialogActivity.onCreate now also finishes immediately when the user has the DISALLOW_ADD_WIFI_CONFIG user restriction, in addition to the existing DISALLOW_CONFIG_WIFI check. - CVE-2024-23710 · platform/frameworks/base
In InstallPackageHelper, two shared-user privilege checks (assertPackageWithSharedUserIdIsPrivileged and a second scan-time block guarded by SCAN_AS_PRIVILEGED and skipVendorPrivilegeScan) now also require !pkg.isLeavingSharedUser(), so packages leaving their shared user are excluded from both. - CVE-2024-23712 · platform/frameworks/base
AppOpsService now validates the proxy attribution tag on the note and start operation paths (nulling tags not declared in the proxy or target package), and ParsedAttributionImpl.MAX_NUM_ATTRIBUTIONS is reduced from 10000 to 1000. - CVE-2024-23713 · platform/frameworks/base
In NotificationManagerService.migrateNotificationFilter, a VersionedPackage is now added to the listener's NotificationListenerFilter only when the resolved uid is not INVALID_UID, so packages whose uid cannot be resolved for a user are no longer stored in the filter.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | April 1, 2024 | Bulletin published |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).