CVE-2025-22428: Android Settings App Local Privilege Escalation Vulnerability
Summary
CVE-2025-22428: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. Affects platform/packages/apps/Settings across 4 version ranges.
>= 13:0, < 13:2025-04-01
>= 14:0, < 14:2025-04-01
>= 15:0, < 15:2025-04-01
>= 15-next:0, < 15-next:2025-04-01
Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Settings app is a core component of the Android operating system, responsible for managing device settings and configurations. It allows users to customize their devices, manage applications, and control system functionalities. This app is crucial for user experience and system integrity. However, it has been found to contain a vulnerability that could allow unauthorized permission grants across user profiles.
Vulnerability Detail
In the hasInteractAcrossUsersFullPermission method of AppInfoBase.java, a logic error exists that permits the primary user to inadvertently grant permissions to applications on secondary user profiles. This flaw can lead to local escalation of privilege, allowing malicious apps to gain elevated permissions without requiring additional execution privileges. Exploitation does not necessitate user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2025-22428 vulnerability in the Android Settings app poses a significant risk of local privilege escalation due to a logic error. Users are strongly advised to update to the latest patched versions to protect their devices from potential exploitation.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
CVE-2025-22428 is a vulnerability in the Android Settings app that allows a primary user to grant permissions to apps on secondary user profiles due to a logic error.
If exploited, this vulnerability can allow malicious applications to gain elevated permissions on secondary user profiles, potentially compromising user data and privacy.
No, user interaction is not needed for exploitation, making it particularly concerning.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating the app to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
