CVE-2025-0076: Android Frameworks Base Package Local Information Disclosure Vulnerability
Summary
CVE-2025-0076: In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities for application development and system operations. It includes various libraries and APIs that allow developers to create applications that can interact with the Android system. This package is crucial for managing user interfaces, system services, and application lifecycle. However, it is susceptible to vulnerabilities that can lead to unauthorized access to sensitive information.
Vulnerability Detail
In multiple locations within the Android Frameworks Base package, there exists a vulnerability that allows unauthorized access to icons belonging to another user due to a missing permission check. This oversight can lead to local information disclosure, where sensitive data may be exposed without requiring additional execution privileges or user interaction. The vulnerability is particularly concerning as it could be exploited by malicious applications to gain insights into user data that should remain private.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional permission checks in their applications to restrict access to sensitive user data. This can be done by verifying user permissions before displaying any icons or information that may belong to other users.
Conclusion
The CVE-2025-0076 vulnerability in the Android Frameworks Base package poses a significant risk of local information disclosure. It is crucial for developers to update their packages to the latest versions and implement necessary permission checks to safeguard user data.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-0076 is a vulnerability in the Android Frameworks Base package that allows unauthorized access to user icons due to a missing permission check.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to local information disclosure, allowing unauthorized access to sensitive user data without additional execution privileges.
Update the Android Frameworks Base package to the patched version using the provided links to ensure that the vulnerability is mitigated.
Yes, implement additional permission checks in your application to restrict access to sensitive user data as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
