-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.google.android.gms:play-services-basement | maven | < 18.0.2 | 18.0.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability centers on improper PendingIntent mutability in notifications. Analysis of Google's standard notification patterns and the CWE-471 context indicates the NotificationCompatBuilder class (core to Play Services' notification handling) would contain the vulnerable PendingIntent creation logic. The functions building notifications and their content intents would show PendingIntent.get*() calls missing FLAG_IMMUTABLE in pre-18.0.2 versions. Runtime detection would observe these builder methods creating mutable intents when handling notification-related operations.
Ongoing coverage of React2Shell