Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-0460 — youtube-android-player-api

🟡 CVSS 5.1 — Medium ✅ No Known Exploit CWE-470 NVD
5.1
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s ClassLoader. A potential vulnerability in the binding logic used by the client SDK where the SDK ends up calling bindService() on a malicious app rather than YT Main App. This creates a vulnerability where the SDK can load the malicious app’s ClassLoader instead, allowing the malicious app to load arbitrary code into the calling app whenever the embedded SDK is invoked.

In order to trigger this vulnerability, an attacker must masquerade the Youtube app and install it on a device, have a second app that uses the Embedded player and typically distribute both to the victim outside of the Play Store.

How this vulnerability can be exploited

This issue can be reached from an adjacent network, attack complexity is high, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity high, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N

  • Attack vector: Adjacent network — the attacker has to sit on the same local or logical network.
  • Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: Required — someone has to click, open or visit something.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: Low — limited, and the attacker does not choose what is affected.
  • Integrity impact: High — total loss, or loss the attacker controls.
  • Availability impact: None.

Weakness class

CVE-2023-0460 is classified as CWE-470: Unsafe Reflection. Input selects which class or method to invoke, letting an attacker reach code that was never meant to be callable.

Affected software

CVE-2023-0460 is recorded against 1 package.

  • youtube-android-player-api (from 1.2 up to 1.2.2)

Timeline and source

Published on 1 March 2023 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

developers.google.com
developers.google.com

Same weakness in other software

These advisories are the same class of weakness (CWE-470: Unsafe Reflection) in other software:

Details

Severity MEDIUM
CVSS Score 5.1
CVSS Vector CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N
CWE CWE-470
Public Exploit ✅ No
Source NVD
Published 2023-03-01
Updated 2026-08-20
Modified 2026-06-17
Fix URL N/A

Affected Packages

Software From version Fixed in
youtube-android-player-api 1.2 1.2.2

Vulnerability Monitoring

Track new vulnerabilities in youtube-android-player-api

CVE-2023-0460 is rated CVSS 5.1 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓