CVE-2018-9469 is a high severity missing permission check that allows creation of a spoofed shortcut in the shortcut manager (multiple functions in ShortcutService.java). NVD scores it 7.8. Google fixes it at security patch level 2018-09-01 or later. Install the device update that reaches that level.
What's affected
- Product: Android, in the shortcut manager (multiple functions in ShortcutService.java).
- Releases listed by the bulletin: 7.1.1, 7.1.2, 8.0, 8.1 and 9. The NVD product list shows only some Android releases, so treat the bulletin as the fuller list.
- Fixed in: security patch level 2018-09-01 or later, according to the Android Security Bulletin for September 2018.
- Impact in the record: local escalation of privilege in a privileged app, user interaction needed.
- Severity: NVD scores it 7.8 High (vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The bulletin lists it as High, type EoP. The two ratings agree.
- Weakness classes: CWE-862 (Missing Authorization), CWE-787 (Out-of-bounds Write).
How to check if you're exposed
- On the device, open Settings and find the Android security patch level, usually under About phone. The exact path varies by manufacturer. A date earlier than 2018-09-01 means the fix is not present.
- With a USB debugging connection, run
adb shell getprop ro.build.version.security_patch. It prints the patch level as a date. You need 2018-09-01 or later. - For a fleet, export the patch level from your mobile device management console and filter for dates earlier than 2018-09-01.
- Match each device against the release list above. Devices on releases outside it are not named for this CVE, but check them against the other entries in the same bulletin.
What to do now
- Identify every Android device in scope and record its current security patch level.
- Roll out the manufacturer or carrier update that reaches 2018-09-01 or later. Google publishes the fixes, but each device maker decides when its devices receive them.
- For devices that no longer receive updates, plan replacement or limit what they can reach, such as corporate mail and internal apps.
- Write the update policy down, with a maximum patch age, and report exceptions.
Why it matters
Note that Android 7.0 is not in this list, unlike most entries. The weakness is a missing authorization check, so the question for each affected function is who was allowed to call it.
A shortcut is a promise to the user about what will open when they tap it. A missing permission check let an app create one it should not have been allowed to, which can send a privileged app somewhere unexpected. Missing authorization is among the most common access control failures, and it is usually fixed by adding the check. The record's KEV flag is false, so CISA does not list it as exploited. The bulletin says Google had no reports of active customer exploitation or abuse of the newly reported issues in it. That is the absence of a report in the sources read, not proof that no one has tried.
Quick check
What does a spoofed shortcut do?
The record only says a spoofed shortcut could be created, leading to escalation of privilege in a privileged app. It does not describe more, so do not assume more.
Which patch level should I look for?
The Android Security Bulletin for September 2018 places this fix at 2018-09-01. Any date at or after 2018-09-01 includes it. Some makers ship it under a different update name, so check the date.
Sources
- Android Security Bulletin for September 2018: Affected releases, severity, type and the patch level that carries the fix.
Last reviewed: 19 October 2026.
