CVE-2025-22419: Telephony Service Vulnerability Leading to Tapjacking Exploits
Summary
CVE-2025-22419: In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. Affects platform/packages/services/Telephony versions < 15-next:2025-04-01. Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Telephony package in Android is responsible for managing telecommunication services, including voice calls and SMS. It plays a crucial role in enabling communication features on Android devices. However, this package has been identified as vulnerable to a tapjacking or overlay attack, which can mislead users into enabling malicious phone call forwarding.
Vulnerability Detail
This vulnerability arises from the potential for a tapjacking or overlay attack, where a malicious application can overlay its interface on top of legitimate applications, tricking users into performing unintended actions. The exploitation of this vulnerability can lead to local escalation of privilege, requiring user interaction to execute. This poses significant risks, as it can allow attackers to manipulate call forwarding settings without the user's consent.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should be cautious about granting permissions to applications that request access to telephony services. Avoid installing apps from untrusted sources and regularly review app permissions to minimize the risk of exploitation.
Conclusion
The CVE-2025-22419 vulnerability in the Android Telephony package poses significant risks due to its potential for exploitation through tapjacking attacks. Users are advised to update their packages to the latest patched versions and remain vigilant about app permissions to mitigate risks.
See every vulnerability recorded for platform/packages/services/Telephony →
FAQ
CVE-2025-22419 is a vulnerability in the Android Telephony package that allows for tapjacking attacks, potentially leading to unauthorized call forwarding.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If you cannot update your device, ensure that you only install trusted applications and regularly check app permissions to limit exposure to this vulnerability.
The risks include unauthorized manipulation of call forwarding settings, which can lead to privacy breaches and potential financial loss.
Yes, Vulert provides a service that uses the gradle.lockfile to monitor and alert for open-source vulnerabilities in your software without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/services/Telephony.
