CVE-2024-0015 is a High severity (CVSS 7.8) elevation of privilege flaw in the Framework component of Android, in convertToComponentName in DreamService.java. Google fixed it in the January 2024 Android Security Bulletin. Devices with security patch level 2024-01-01 or later include the fix, so check each device's patch level and update.
What's affected
- Platform: Android (AOSP versions 11, 12, 12L and 13 per the bulletin). Component: the Framework component.
- Fixed in: security patch level 2024-01-01 or later.
- Severity: High, CVSS 7.8, in the NVD record. The bulletin also rates it High.
- Exploitation: the record's KEV flag is false, and the bulletin does not say it is exploited in the wild or in targeted attacks.
- Detail: The record describes intent redirection in convertToComponentName of DreamService.java, which makes it possible to launch arbitrary protected activities. That leads to local elevation of privilege, and no user interaction is needed.
The two sources differ. The NVD record lists Android 11, 12, 12L, while the bulletin lists 11, 12, 12L and 13. The bulletin is the vendor source, so treat every version it lists as affected and use the patch level as your test.
Android fixes reach people through device makers and carriers, so the date a patch exists and the date it lands on a device can be months apart. Patch level, not version number, tells you which one you have.
How to check if you're exposed
On a device connected with adb, read the patch level:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A first value of 2024-01-01 or later includes the fix. The date format sorts correctly as text, so a simple string comparison works in a script. On the device, open Settings, About phone, Android version, and read the Android security update date.
For managed fleets, export patch levels from your mobile device management console and flag every device below 2024-01-01. Pay attention to devices that no longer receive updates, since they cannot reach the fixed level at all.
What to do now
- Collect the security patch level of every Android phone, tablet and embedded device you manage.
- Flag devices below 2024-01-01.
- Install the vendor update that carries the January 2024 fixes. If the device maker has not shipped one, ask for a date.
- Set a minimum patch level in your device policy, and block or limit access for devices that fall behind.
- For devices that will never get the update, retire them or keep them away from sensitive data.
Why it matters
The record maps this to CWE-280 (improper handling of insufficient permissions or privileges). The code does not handle a case where the caller lacks the right permission, so a protected action can proceed.
Local means the attacker, or a malicious app, must already run code on the device. This flaw raises what that code can do, so it matters most on devices that install apps from several sources or hold work data. The record does not flag it in CISA's Known Exploited Vulnerabilities catalog, and the bulletin does not report exploitation. That is not proof that it is safe, only that no source I read says it is being used.
An operating system flaw like this never appears in your app's dependency tree, so a package scan will not catch it. It shows up as a device inventory problem. A free in-browser dependency scan covers the libraries your own mobile app ships, which is the part of the Android stack you do control.
Quick check
Which patch level fixes CVE-2024-0015?
Security patch level 2024-01-01 or later, according to the Android Security Bulletin for January 2024.
Is CVE-2024-0015 exploited in the wild?
The record's KEV flag is false and the bulletin does not report exploitation. Check the CISA catalog for changes.
Sources
Last reviewed: 19 October 2026.
