Preface: The reason why an unparcel error involving Parcel and BaseBundle is considered a critical Common Vulnerabilities and Exposures (CVE) is due to the potential security risks it poses. Specifically, such errors can lead to: Data Corruption, Security Vulnerabilities and Denial of Service (DoS).

Background: BaseBundle[.]java in Android is a class that provides a mapping from String keys to values of various types. It serves as a base class for Bundle and PersistableBundle, which are more commonly used in Android development. Here are some key functions of BaseBundle:

• Storing and retrieving data: It allows you to store various types of data (like int, boolean, String, etc.) and retrieve them using specific keys.
• Clearing data: You can remove all elements from the mapping using the clear() method.
• Checking for keys: The containsKey(String key) method lets you check if a particular key exists in the mapping.

In most cases, developers work directly with Bundle or PersistableBundle, which extend BaseBundle and provide additional functionalities.

Vulnerability: An unparcel error in Android, often caused by issues with Parcel and BaseBundle, can lead to several consequences.

Ref: If an attacker can manipulate the data being parceled, they might exploit the unparceling process to execute arbitrary code or gain unauthorized access to sensitive information.

Official announcement: Please refer to the link for details –https://android.googlesource.com/platform/frameworks/base/+/ece83fb425b1e912a036e9985b710910e2e3ca37