CVE-2023-40109 is a high severity (CVSS 7.8) Android flaw in createFromParcel of UsbConfiguration.java. A permissions bypass allows a background activity launch, which can lead to local escalation of privilege. Devices on security patch level 2023-11-01 or later carry the fix.
What's affected
The record lists Google Android and scores CVE-2023-40109 at 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-266 (incorrect privilege assignment), which here shows up as a permissions bypass.
Our sources disagree on versions here. The NVD record lists Android 11.0, 12.0 and 12.1 as affected. The bulletin's table lists AOSP versions 11, 12, 12L, 13 and 14. Because the bulletin is the vendor source, plan on every supported Android release up to 14 until your device maker says otherwise.
The fix is in the Android security patch level 2023-11-01 or later. The Android Security Bulletin lists the issue under the Framework component with a type of elevation of privilege and a High severity.
How to check if you're exposed
On a device you manage, the quickest test is the security patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be 2023-11-01 or later.
If you manage a fleet or test devices over a cable, the same value is available from the shell:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch string earlier than the one above means the November 2023 fixes are not present. Many Android vendors ship their own schedule, so also check the manufacturer's bulletin for the model rather than assuming the platform date applies. For app and image inventories, an open source dependency scan will not see operating system flaws like this one, so track it through your mobile device management compliance reports.
What to do now
- List the Android devices in scope, including test phones, kiosks and tablets, and record their security patch level.
- Update anything below 2023-11-01 to the latest build from the device maker or carrier.
- For devices that can no longer receive updates, retire them from access to company data or move them to a restricted network segment.
- Set a compliance rule in your mobile device management tool that flags devices more than one or two patch levels behind.
- Tell users to install apps only from trusted stores while updates roll out, since the flaw is reached through a local app or file.
Why it matters
The cause is a permissions bypass in code that rebuilds a USB configuration object from a parcel. A parcel is the way Android passes data between processes. When the receiving side does not check who is allowed to ask for what, an app can steer the system into starting an activity from the background, which normally requires special rights.
That matters because background activity launch restrictions are one of the guard rails that stop a rogue app from taking over the screen. The description says user interaction is needed, so this is not a silent flaw, but it needs no extra execution privileges to start.
It is a good example of why mobile patch levels belong in the same risk register as server packages. The weakness is classed as CWE-266 and the bulletin rates it High.
Quick check
Is CVE-2023-40109 remotely exploitable?
The record's vector is local (AV:L). The weakness sits in code on the device, and the description says it leads to local escalation of privilege. It does not describe a network attack path.
Does the record say this is exploited in the wild?
No. The record's KEV flag is false, and the November 2023 bulletin entry we read does not say it is exploited. Treat it as a patch to apply on schedule, not an emergency.
Sources
Last reviewed: 19 October 2026.
