CVE-2022-2390
Mutable pending intent in Google Play services SDK
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mutable pending intent in Google Play services SDK
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
- Record
CVE-2022-2390- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-471
- Updated
- 2026-11-02
EUVDEUVD-2022-6540
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
- Record
EUVD-2022-6540- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cm6r-892j-jv2g
Google Play Services SDK leads to apps having incorrectly set mutability flag
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
- Record
GHSA-cm6r-892j-jv2g- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-471
- Updated
- 2026-11-02
NVD
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
- Record
CVE-2022-2390- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-471
- Updated
- 2026-11-02
OSVGHSA-cm6r-892j-jv2g
Google Play Services SDK leads to apps having incorrectly set mutability flag
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
- Record
GHSA-cm6r-892j-jv2g- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-471
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.google.android.gms:play-services-basementMaven |
before 18.0.2 | 18.0.2 |
com.google.android.gms:play-services-basementMaven |
before 18.0.2, plus listed versions 10.0.010.0.110.2.010.2.110.2.4 Show 42 moreShow less10.2.611.0.011.0.111.0.211.0.411.2.011.2.211.4.011.4.211.6.011.6.211.8.012.0.012.0.115.0.015.0.116.0.116.1.016.2.017.0.017.1.017.1.117.2.017.2.117.3.017.4.017.5.017.6.018.0.018.0.18.1.08.3.08.4.09.0.09.0.19.0.29.2.09.2.19.4.09.6.09.6.19.8.0 |
18.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2390 is a medium vulnerability (CVSS 6.1) in Google Llc Play Services Sdk, published August 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in com.google.android.gms:play-services-basement 18.0.2.