iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google’s March 2023 Android security bulletin flagged CVE-2023-20963, a high-severity Android Framework flaw, as potentially subject to limited, targeted exploitation. A separate report by SecurityWeek said Lookout found that the Chinese shopping app Pinduoduo exploited the flaw before Google released a patch. These are historical reports from 2023, not evidence of a new warning or current active exploitation.
What was the Android flaw?
CVE-2023-20963 was an elevation-of-privilege vulnerability in Android’s Framework. Google’s March 2023 bulletin listed it as high severity and identified AOSP Android 11, 12, 12L, and 13 as affected versions. The bulletin described a local privilege escalation that could occur after an app was updated to a higher Target SDK; it required no additional execution privileges and no user interaction. Google’s March 2023 Android Security Bulletin was published March 6 and updated May 8, 2023.
What did Google and CISA say about exploitation?
Google’s bulletin
Google used careful language: “There are indications that CVE-2023-20963 may be under limited, targeted exploitation.” That statement does not say attacks were widespread or indiscriminate. It is also a statement about the situation reported in the March 2023 bulletin, not confirmation of current activity.
Reported Pinduoduo connection
In an April 14, 2023 report, SecurityWeek reported that Lookout found Pinduoduo had exploited the vulnerability before Google released the March patch. Keep that app-specific finding attributed to Lookout as reported by SecurityWeek; it is distinct from the wording in Google’s bulletin.
#1 Best Overall
- THE EVERYTHING TRACKER: Protect lost or stolen stuff and make family life easier. Attach to everyday things like keys, water bottles, or bags
- STAY SAFE WITH SOS: Discreetly trigger an SOS alert to your loved ones in unsafe situations
- FIND YOUR THINGS: Ring your misplaced Tile, or track it down in the free app
- FIND YOUR PHONE: Phone hiding under a cushion? Use your Tile to make it ring — even when silenced
- USE WITH LIFE360: Add your Tiles to Life360 — a top family connection and safety app – to see everything and everyone on the same map
CISA listing and federal deadline
SecurityWeek also reported that CISA added CVE-2023-20963 to its Known Exploited Vulnerabilities catalog and required U.S. federal agencies to patch within two weeks. That reported deadline applied to government organizations, not ordinary consumers. The CISA entry itself is not directly cited here, so the listing and deadline are attributed to SecurityWeek’s contemporaneous account.
How to check your Android security update
For a device you still use, install the newest security update offered for its exact model through the manufacturer’s official update channel. Do not treat the 2023 patch-level strings as an adequate target today: they identify historical fixes, while devices and update schedules vary by manufacturer.
Rank #2
- Works with Apple Find My: Just use the pre-installed Find My app and add SmartTrack Link to the Items tab. You can then locate it anywhere in the world using Apple's network of millions of devices. Note: Apple Find My features only work if used with an iOS, iPadOS, or macOS device.
- Find Your Phone in Silent Mode: Avoid tearing up your apartment searching for your phone. With just a double tap, your phone rings—even in silent mode.
- Free Left-Behind Alerts: Avoid losing your belongings in the first place with instant left-behind alerts via the eufy Security app—with no added fee.
- Always Linked to Your Item: If something's lost, you're always connected via Link's QR code. A person who finds your item can scan and see only the contact information you share.
- Share with Friends and Family: With the eufy Security app you can let others know the location of your items too.
- Open Android Settings and look for Security or Security & privacy; labels vary by device.
- Open the security information or update screen and check the displayed Android security update or security patch level.
- Use the system update option in Settings to check for and install updates offered for your device. Follow the manufacturer’s instructions if the update must be downloaded or installed another way.
- After installation, return to the security information screen and confirm the displayed patch level has changed as expected.
Google’s bulletin says patch level 2023-03-01 or later addressed the issues associated with the March 1 patch level, and 2023-03-05 or later addressed the March 5 issues and earlier patch levels. Those dates explain the 2023 bulletin; they are not a recommendation to stop updating once a device reaches them. Google’s bulletin links to device-version and patch-check instructions. Manufacturers control when applicable updates reach their devices, so not every Android phone received the fix on the same date.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What should you do about Pinduoduo?
SecurityWeek reported that Google suspended Pinduoduo from Google Play on March 21, 2023, after malware was discovered in versions distributed through other websites. The report said Google warned users to uninstall copies that had not been downloaded from Play. If you have a copy obtained outside Google Play, do not keep using it; uninstall it and avoid reinstalling APKs from untrusted sites. This historical report does not establish the current status of every app distribution or every user’s device.
Rank #3
- REDESIGNED TO DO MORE: The redesigned Galaxy SmartTag2 is made so you can keep calm and keep track¹; Its design makes it easy for you to tag and carry your belongings
- EASY TO USE: It's IP67-rated water- and dust-resistant², activates your compatible IoT devices³ and stays powered for up to 500 days⁴ or even up to 40% more on Power Saving Mode⁵
- RELAX, YOU'VE GOT IT TAGGED: Simply register a new Galaxy SmartTag2 and get started right away with SmartThings Find; With its intuitive tracking experience, you now have a way to keep track of things you love right in the palm of your hand¹
- SEARCH NEAR WHEN IT'S NOT FAR: Lose something? Switch on Search Nearby⁶ and get instructions to your item's location via Compass View⁷; If you still don't see it, just ring your Galaxy SmartTag2 to have it send out an audible signal
- TAGGED & TRENDY: Cover your Galaxy SmartTag2 with a colorful Silicone Case for protection and a smooth touch – or a Rugged Case with a non-slip pattern on the side and additional bumper on the bottom⁸; Both have a carabiner ring attachment
Google says Play Protect is enabled by default on devices with Google Mobile Services and is especially important when installing apps outside Google Play. It is a protective layer, not a replacement for Android system security updates. Google Play Protect information.
Quick Recap
Best Value
- Works with iOS & Android Systems - Compatible with Apple Find My and Android Find Hub, this Bluetooth tracker lets you locate items directly from your phone. Easy pairing and reliable connection let you start tracking in minutes, no tech skills required (Note: Cannot pair with iOS and Android devices simultaneously.)
- Find Items Fast with Loud Ringing - Misplaced something nearby? Tap your phone to trigger a loud 80dB ring and locate your items within a 40m range. No guessing, no searching, just quick results when you are in a hurry or heading out the door
- Certified Security with Full Privacy Protection - Built with Apple MFi and Google GMS certification, this item tracker follows strict security standards. Location data is encrypted and anonymized, giving you reliable tracking without sacrificing personal privacy
- Premium Fabric Finish, Built for Daily Use - Featuring a refined fabric-textured exterior, this tracker combines durability with style. IP65 waterproof and drop resistant, it is designed to handle everyday splashes, bumps, and outdoor use with ease
- Share Access with People You Trust - Easily share your tracker with family or friends. iOS supports up to 5 shared users, Android supports up to 10. Everyone can help locate shared items while you stay in full control of permissions
Rank #4
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
What this warning does—and does not—establish
- Google classified CVE-2023-20963 as a high-severity Android Framework elevation-of-privilege issue affecting AOSP Android 11, 12, 12L, and 13 in its March 2023 bulletin.
- Google reported indications of limited, targeted exploitation; SecurityWeek separately attributed the Pinduoduo finding to Lookout.
- The reports do not establish how many devices were actually compromised or prove that every Pinduoduo installation was malicious.
- The practical response is software updating and careful app installation, not a repair kit, accessory, or third-party security product.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
