CVE-2023-20938PoC(google / android)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch google android systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel

google CVEs Back to dashboard

7.5/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-416

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
10 mentions across 7 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 9 signals
Disclosure: 2 classified signals
Peaked 4d ago at 3 mentions (2026-10-16); latest day: 1
10 total mentions across 7 days

Affected systems

Vendors

google

Products

android

1 version affected across 1 product

Deep dive

Activity timeline10 mentions / 7d

Signal classification5 categories

PoC

333.3%

Disclosure

222.2%

Exploit

222.2%

General

111.1%

Active Exploitation

111.1%

Referenced assets32 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	1	General1
2026-10-15	1	PoC1
2026-10-16	3	Disclosure2Exploit1
2026-10-19	2	Active Exploitation1Exploit1
2026-10-30	1	PoC1
2026-11-02	1	PoC1

Full discourse10 posts

eShard@eshard19d
Exploit
In case you missed it: we started publishing a full Android kernel exploit chain built on CVE-2023-20938. Part 2 is coming soon. https://www.eshard.com/blog/kernel-uaf-1-trigger
Post summary
The text announces the publication of a full Android kernel exploit chain based on CVE-2023-20938, with a link to a detailed blog post. The primary focus is on sharing functional exploit code/methods rather than a PoC, patch, or active exploitation reporting.
018071563.8K
1.8K followersView on X
eShard@eshard8d
PoC
We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 👉 Start part 1: https://www.eshard.com/blog/kernel-uaf-1-trigger https://t.co/BarhiFZI49
Post summary
The text announces the release of a proof‑of‑concept Android kernel exploit chain for CVE‑2023‑20938 (a Binder use‑after‑free) on a Pixel 6 running Android 12, providing a link to the first part of a detailed blog.
03032211.3K
1.9K followersView on X
Nicolas Krassas@Dinosn22d
Disclosure
Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging https://www.eshard.com/blog/kernel-uaf-1-trigger
Post summary
The text announces CVE-2023-20938 as an Android Binder Use-after-Free vulnerability and links to a technical deep-dive blog post analyzing it with Time-Travel Debugging, without mentioning exploits, PoCs, patches, or active exploitation.
00012103.5K
162.7K followersView on X
eShard@eshard22d
Exploit
We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 🔗 https://www.eshard.com/blog/kernel-uaf-1-trigger
Post summary
The text announces the publication of a full Android kernel exploit chain targeting CVE-2023-20938 (a use-after-free in Binder), with a link to a detailed technical blog post.
020108564
1.8K followersView on X
eShard@eshard23d
PoC
𝚘𝚏𝚏𝚜𝚎𝚝𝚜_𝚜𝚒𝚣𝚎 = 15. That’s all it takes for Android’s Binder driver to free an object it’s still using. Part 1 of our CVE-2023-20938 exploit chain: the trigger. Every stage recorded with time-travel debugging, hosted trace included. 🔗 https://www.eshard.com/blog/kernel-uaf-1-trigger https://t.co/HJj4IQ73TT
Post summary
The text announces Part 1 of an exploit chain for CVE-2023-20938 (a kernel UAF in Android's Binder driver), linking to a blog with time-travel debugging traces, serving primarily as a PoC share. Technical details about the vulnerability trigger are provided, but no named exploit tool or active exploitation is indicated.
12042385
1.8K followersView on X
/r/netsec@_r_netsec22d
Disclosure
Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging https://www.eshard.com/blog/kernel-uaf-1-trigger
Post summary
The text announces a technical deep-dive analysis of CVE-2023-20938 (Android Binder UaF) using Time-Travel Debugging, providing vulnerability type details but without mentioning exploits, PoCs, patches, or active exploitation.
02032736
34.3K followersView on X
eShard@eshard5d
PoC
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12. Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address. 👉 https://eshard.com/blog/kernel-uaf-4-read #android #cve https://t.co/yIvo6J4E39
Post summary
The tweet announces technical details for CVE‑2023‑20938—a Binder use‑after‑free on Android 12—and links to a blog that contains a proof‑of‑concept for Part 4 of an Android kernel exploit chain.
01021151
1.9K followersView on X
Machina Record@MachinaRecord19d
Active Exploitation
【リンク集：週末のセキュリティ関連ニュース/記事】＜脆弱性＞・中国関連APT、BeyondTrustの脆弱性をゼロデイとして悪用していた（CVE-2026-102764） https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/ ・Drupalが致命的なリモートコード実行脆弱性のパッチを公開、まもなくエクスプロイトが開発される可能性があると警告（CVE-2026-108097, CVE-2026-108099） https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/ ・ハッカーがSiteGuard WAFの脆弱性を悪用し、管理者としてコマンドを実行（CVE-2026-106931） https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/ ・F5社とJuniper Networks社が致命的な脆弱性のパッチを公開（CVE-2026-97205ほか） https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/ ・致命的なBlockStrapの脆弱性により、ハッカーがMagentoサーバーでコード実行可能に（CVE-2026-103849） https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/ ・37年前の共有メモリ関連コードに起因する脆弱性を連鎖させ、OpenBSDのroot権限取得する手法を研究者らが実証 https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html ・Rapid7 Analysis：GitLabがCI/CD正規表現処理の整数オーバーフロー（CVE-2026-97229） https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/ ・FortiOSの脆弱性経由で展開されたマルウェアPEERSTITCH、タグ付けされたVPNセッションでチェックを回避（CVE-2025-61624） https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html ・16年前から存在するBroadcom社製Wi-Fiの脆弱性により、攻撃者がパスワードなしでルーターを乗っ取れるように https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html ＜マルウェア・その他脅威＞・水処理施設や電力網に新たなサイバー脅威　ブリティッシュコロンビア大学の研究者らが発見 https://www.eurekalert.org/news-releases/1147784 ・MALFEXキャンペーンで使用のnpmパッケージ「imgdecode」、Windowsのネイティブアドオンにシェルコードを隠す https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html ・AOMEI Backupperのアップデートサーバーから取得したファイルが数分間にわたり改ざんされる　バックドアの配布が目的 https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html ＜データ侵害/サイバー犯罪＞・バーガーキング・ジャパンのデータ侵害で顧客レコード1,100万件が流出 https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/ ・ConnectWise、Cloud Backupなどのサービス提供を一時停止　Microsoft 365のテナントへの攻撃受け https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html ・OpenCodeが侵害を確認　ユーザーが身に覚えのないAI利用料金の請求を報告 https://www.notebookcheck.net/OpenCode-hacked-users-urged-to-revoke-their-API-keys.1426957.0.html ＜AI関連＞・AIエージェントがインドの組織に不正アクセス　インドCERT-Inが警告 https://securityaffairs.com/201130/ai/ai-agents-accessed-indian-organizations-without-authorization-cert-in-warns.html ・アンソロピック、外部のAI監視団体に「社員と同等」のアクセス権を付与 https://arstechnica.com/ai/2026/10/anthropic-gives-outside-ai-watchdog-employee-like-access/ ・米国でサイバーセキュリティ関連の求人が26％減少　AIセキュリティエンジニアの需要が急増する中 https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/ ・OpenAIのモデルがポータルなどをハッキング　タスク完了目的で暗号資産ウォレットから資金流用も https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/ ・GhostShares：メタのAI「Muse」が最先端AI研究所との極秘面談に向けた準備資料を漏洩 https://blog.claroc.io/ghostshares-muse-passive-dns/ ・OpenAIのモデルが暗号資産ウォレットやWebサイトなどに不正アクセス https://arstechnica.com/security/2026/10/openai-models-hacked-a-crypto-wallet-and-breached-more-websites/ ・インド、AIエージェントによる最新の不正行為を報告 https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/ ＜サイバー戦/APT/国家型アクター/地政学関連＞・フランスのデモ、17日の抗議活動に先駆け参加者に「Bitchat」の使用を呼びかけ　中国やインドでブロックされたオフラインアプリ https://ministryofcyberaffairs.com/news/as-france-marches-on-17-october-protesters-turn-to-bitchat-the-offline-app-china-india-has-blocked-f3ca5640-f898-4eea-a905-46e9c02a2e85 ・UAT-11985、偽イベントの招待状で台湾の研究機関関係者を狙う　Google使ったAitMフィッシング https://thehackernews.com/https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html2026/10/uat-11985-uses-fake-event-invites-to.html ＜逮捕/テイクダウン/制裁/違反/その他法執行関連＞・OpenAI、子どもの安全やデータ利用めぐり提訴される https://www.malwarebytes.com/blog/ai/2026/10/openai-sued-over-children-safety-and-data-use ＜プライバシー＞・Telegram、米当局に提供している情報が明らかに　裁判所の提出書類より https://cyberinsider.com/telegram-sharing-user-data-with-us-authorities/ ＜リサーチ/攻撃手法/TTP＞・ITサポートポータルに潜む非構造化データの罠　ウォール街の極秘情報が密かに流出 https://ponderwall.com/index.php/2026/10/18/ey-data-breach-wall-street-goldman-sachs/ ・カーネルのUaFからroot権限を取得　使用中のオブジェクトを解放（CVE-2023-20938） https://www.eshard.com/blog/kernel-uaf-1-trigger ＜その他＞・オープンソースにおけるデジタル主権確保、実際に機能させるための地味な取り組みに https://www.theregister.com/software/2026/10/16/open-source-sovereignty-gets-down-to-the-boring-business-of-making-it-work/5303206
Post summary
This Japanese-language security news roundup reports multiple CVEs with clear evidence of active in-the-wild exploitation by APT groups and hackers, alongside patch releases and technical vulnerability analyses across various vendors and products.
000201.7K
1.3K followersView on X
Cesar Mario@warlockk874d
Serie Kernel UaF to Root (eShard), Binder UAF CVE-2023-20938 en Pixel 6/Android 12: 1 Trigger → 2 Leak → 3 Write → 4 Read (nuevo): cross-cache a epitem + f_inode para arbitrary read. Cuando entendés la memoria por debajo, el bug deja de ser magia 🔍 https://www.eshard.com/blog/kernel-uaf-4-read
0000153
398 followersView on X
UNDERCODE TESTING@UndercodeUpdate137d
General
🚨 From UAF to Root: Deconstructing #Android's Cross-Cache Exploit #CVE-2023-20938 + Video https://undercodetesting.com/from-uaf-to-root-deconstructing-androids-cross-cache-exploit-cve-2023-20938-video/ Educational Purposes!
Post summary
The post references CVE‑2023‑20938 and provides a video analysis, but lacks concrete PoC code, exploitation tools, or patch information, meaning it mainly offers a high‑level deconstruction without actionable exploit details.
0000053
635 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	-	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2023-20938

eShard[verified]@eshardExploit

The text announces the publication of a full Android kernel exploit chain based on CVE-2023-20938, with a link to a detailed blog post. The primary focus is on sharing functional exploit code/methods rather than a PoC, patch, or active exploitation reporting.

eShard[verified]@eshardPoC

The text announces the release of a proof‑of‑concept Android kernel exploit chain for CVE‑2023‑20938 (a Binder use‑after‑free) on a Pixel 6 running Android 12, providing a link to the first part of a detailed blog.

Nicolas Krassas[verified]@DinosnDisclosure

The text announces CVE-2023-20938 as an Android Binder Use-after-Free vulnerability and links to a technical deep-dive blog post analyzing it with Time-Travel Debugging, without mentioning exploits, PoCs, patches, or active exploitation.

eShard[verified]@eshardExploit

The text announces the publication of a full Android kernel exploit chain targeting CVE-2023-20938 (a use-after-free in Binder), with a link to a detailed technical blog post.

eShard[verified]@eshardPoC

The text announces Part 1 of an exploit chain for CVE-2023-20938 (a kernel UAF in Android's Binder driver), linking to a blog with time-travel debugging traces, serving primarily as a PoC share. Technical details about the vulnerability trigger are provided, but no named exploit tool or active exploitation is indicated.

eShard[verified]@eshardPoC

The tweet announces technical details for CVE‑2023‑20938—a Binder use‑after‑free on Android 12—and links to a blog that contains a proof‑of‑concept for Part 4 of an Android kernel exploit chain.

Machina Record[verified]@MachinaRecordActive Exploitation

This Japanese-language security news roundup reports multiple CVEs with clear evidence of active in-the-wild exploitation by APT groups and hackers, alongside patch releases and technical vulnerability analyses across various vendors and products.

UNDERCODE TESTING[verified]@UndercodeUpdateGeneral

The post references CVE‑2023‑20938 and provides a video analysis, but lacks concrete PoC code, exploitation tools, or patch information, meaning it mainly offers a high‑level deconstruction without actionable exploit details.