CVE-2023-40104 is a High severity (CVSS 7.5) Android flaw in the ca-certificates package, described as a way to read encrypted TLS data that could lead to remote information disclosure. Google's November 2023 bulletin fixes it at security patch level 2023-11-01 or later, so update affected devices to that patch level.
What's affected
Affected: Android versions 11, 12, 12L and 13, per Google's Android Security Bulletin for November 2023, where this CVE is listed under System with a High severity. Fixed: devices at security patch level 2023-11-01 or later.
The NVD record lists the same Android releases as affected, with a CVSS 3.1 score of 7.5. Both sources agree on High severity and I found no conflict. Patch availability still depends on your device maker or carrier, because the bulletin describes the platform fix and not each vendor's rollout date.
How to check if you're exposed
On a device, open Settings, then About phone, then Android version, and read the Android security update date. It should read 2023-11-01 or later. For managed fleets you can read the same value over adb:
adb shell getprop ro.build.version.security_patch
A date earlier than 2023-11-01 means the fix is missing. Your mobile device management console will usually show this as a column so you can report across the whole estate.
What to do now
- Pull the security patch level for every managed Android device and flag anything older than 2023-11-01.
- Push or request the update from the device manufacturer or carrier, and set a deadline in your device policy.
- Block or quarantine devices that cannot receive updates from sensitive corporate resources.
- Retire devices that have reached end of support from their maker.
- Add a patch level check to your device compliance policy so this question answers itself next time.
Why it matters
The weakness class is CWE-295 (improper certificate validation). The record describes untrusted cryptographic certificates in the ca-certificates package that make it possible to read encrypted TLS data, with remote information disclosure and no user interaction. The score is 7.5 with high confidentiality impact only.
Trust stores decide which certificate authorities a device accepts. If one that should not be there is trusted, traffic secured by a certificate it issued can be intercepted. Updating the store is the fix, which is delivered through the platform patch. NVD published the record on 2024-02-15. The KEV flag is false.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
What patch level fixes this?
Google's bulletin says devices at security patch level 2023-11-01 or later address these issues.
Is it being exploited?
The KEV flag is false and the bulletin entry does not claim exploitation.
Sources
Last reviewed: 19 October 2026.
