What’s Vulnerable › Vulnerabilities

CVE-2022-2390: Mutable pending intent in Google Play services SDK

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-12 · updated 2026-06-17
• Weakness: CWE-471

Description

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.

Affected products

• Google LLC Play Services SDK: before 18.0.2 — fixed in 18.0.2

How to fix

Upgrade to a fixed version: Google LLC Play Services SDK 18.0.2. Check the vendor advisory for mitigations.

References

• https://developers.google.com/android/guides/releases#may_03_2022
• https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement/18.0.2
• https://developers.google.com/android/guides/releases#may_03_2022
• https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement/18.0.2

Get alerted when CVE-2022-2390 or the next vulnerability affects your stack