Google rolled out security fixes addressing CVE-2024-43093 (CVSS 7.8), a high-severity elevation of privilege zero-day vulnerability in the Android Framework impacting versions 12 through 15. The flaw resides within the shouldHideDocument path-filtering method of ExternalStorageProvider.java in the Documents UI component. Due to improper Unicode normalization (CWE-176), malicious local applications can construct crafted file paths that bypass file system filter checks enforced under Android’s Scoped Storage and Storage Access Framework (SAF). Successful exploitation allows unauthorized directory traversal into protected system directories, including /Android/data, /Android/obb, and /Android/sandbox.

Google confirmed that CVE-2024-43093 was subjected to limited, targeted in-the-wild exploitation prior to patch availability, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Threat actors leveraged the bypass to read and exfiltrate sensitive application data, internal caches, and authentication tokens that are normally isolated across application boundaries. Google mitigated the zero-day in the 2024-11-01 security patch level and dispatched modular updates to the Documents UI via Google Play system updates.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Bypassing Scoped Storage path filters via Unicode normalization subverts Android’s application sandboxing model, permitting unprivileged rogue applications to harvest sensitive local databases, session tokens, and encrypted messaging stores from adjacent apps without elevated OS permissions.
• Bullet 2 — Strategic & Defender Imperative: Enterprise mobility administrators must enforce the 2024-11-01 patch level across corporate mobile device fleets, ensure Google Play system updates are current, and deploy Mobile Threat Defense (MTD) agents to detect abnormal inter-app storage access patterns.