CVE-2023-0460 describes a vulnerability in the YouTube Embedded 1.2 SDK for Android, affecting applications that integrate the YouTube player. The flaw allows a malicious application to masquerade as the legitimate YouTube app, tricking the SDK into loading its ClassLoader and executing arbitrary code within the embedding application. This is a high-severity vulnerability (CVSS 7.3) with high impact on confidentiality, integrity, and availability, requiring user interaction and local access for exploitation. While the EPSS score is low, indicating a low likelihood of exploitation in the wild, there is currently no public exploit intelligence, nor is it listed on the KEV catalog or Hot List. Community discussion and media coverage are also absent.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.2, <= 1.2.2CPE matchmatch criteria | cpe:2.3:a:google:youtube_android_player_api:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.