CVE-2025-22416: Android Framework ChooserActivity Local Privilege Escalation Vulnerability
Summary
CVE-2025-22416: In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-04-01
>= 14:0, < 14:2025-04-01
>= 15:0, < 15:2025-04-01
>= 15-next:0, < 15-next:2025-04-01
Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework is a set of libraries and tools that enable developers to create applications for the Android operating system. It provides essential functionalities such as user interface design, data management, and connectivity. ChooserActivity is a component within this framework that facilitates the selection of applications for specific actions, such as sharing content. This vulnerability allows unauthorized access to user images, posing a significant risk to user privacy and data security.
Vulnerability Detail
In the onCreate method of ChooserActivity.java, there exists a flaw that allows a confused deputy scenario, enabling an attacker to view images belonging to other users. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges or user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the available patches as soon as possible.
Conclusion
The CVE-2025-22416 vulnerability in the Android Framework's ChooserActivity poses a serious risk of unauthorized access to user images. It is crucial for developers and users to apply the available patches to mitigate this risk and protect user privacy.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-22416 is a vulnerability in the Android Framework's ChooserActivity that allows unauthorized access to other users' images.
An attacker can exploit this vulnerability to view images belonging to other users without needing additional privileges or user interaction.
The consequences include unauthorized access to sensitive user data, leading to privacy breaches and potential misuse of personal information.
Yes, patches are available for various versions of the Android Framework. Users should update to the latest patched version as specified.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
