CVE-2023-40111 is a high severity (CVSS 7.8) confused deputy flaw in setMediaButtonReceiver of MediaSessionRecord.java in Android 14. An app can make the system send a pending intent on its behalf, leading to local privilege escalation. Security patch level 2023-11-01 or later fixes it.
What's affected
The record lists Google Android and scores CVE-2023-40111 at 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-441 (unintended proxy or intermediary), a confused deputy problem.
Unlike the other November 2023 entries in this series, the record and the bulletin agree here. The record lists Android 14.0 only, and the bulletin lists AOSP version 14 only, so older releases are not named.
The fix is in the Android security patch level 2023-11-01 or later. The Android Security Bulletin lists the issue under the Framework component with a type of elevation of privilege and a High severity.
How to check if you're exposed
On a device you manage, the quickest test is the security patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be 2023-11-01 or later.
If you manage a fleet or test devices over a cable, the same value is available from the shell:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch string earlier than the one above means the November 2023 fixes are not present. Many Android vendors ship their own schedule, so also check the manufacturer's bulletin for the model rather than assuming the platform date applies. For app and image inventories, an open source dependency scan will not see operating system flaws like this one, so track it through your mobile device management compliance reports.
What to do now
- List the Android devices in scope, including test phones, kiosks and tablets, and record their security patch level.
- Update anything below 2023-11-01 to the latest build from the device maker or carrier.
- For devices that can no longer receive updates, retire them from access to company data or move them to a restricted network segment.
- Set a compliance rule in your mobile device management tool that flags devices more than one or two patch levels behind.
- Tell users to install apps only from trusted stores while updates roll out, since the flaw is reached through a local app or file.
Why it matters
A confused deputy bug happens when a trusted component is tricked into using its own authority for someone else. Here the trusted component is system_server, the core Android process. A pending intent is a token that lets its holder run an action as the app that created it. If an app can get system_server to send one, the action runs with system rights instead of the app's.
The record notes user interaction is needed and no extra execution privileges are required. The class is CWE-441. The fix is a single change to MediaSessionRecord.
The lesson for app teams is the same one the Android platform team applies internally. Any component that sends intents or tokens on behalf of callers must check what the caller is allowed to ask for.
Quick check
Do Android 13 and older phones need this fix?
The bulletin lists only AOSP version 14 for this CVE, and the record lists Android 14.0. If your devices run an older release, confirm with the device maker whether the vulnerable code exists there, and still apply the monthly patch level.
Is CVE-2023-40111 remotely exploitable?
The record's vector is local (AV:L). The weakness sits in code on the device, and the description says it leads to local escalation of privilege. It does not describe a network attack path.
Sources
Last reviewed: 19 October 2026.
