Has anyone looked at CVE-2014-8609?

[CovXX]

With the latest OTA we're still vulnerable to "CVE-2014-8609" or "settings pending intent"

Summary from the full disclosure:

In Android = 4.0), Settings application leaks Pendingintent with a blank base intent (neither the component nor the action is explicitly set) to third party application, bad app can use this to broadcast intent with the same permissions and identity of the Settings application, which runs as SYSTEM uid. Thus bad app can broadcast sensitive intent with the permission of SYSTEM.

Now just give me some time