CVE-2025-22430: Android Platform Frameworks Base Local Information Disclosure Vulnerability
Summary
CVE-2025-22430: In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. Affects platform/frameworks/base across 2 version ranges.
>= 15:0, < 15:2025-04-01
>= 15-next:0, < 15-next:2025-04-01
Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Platform Frameworks Base is a core component of the Android operating system, providing essential services and APIs for application development. It plays a critical role in managing system resources, user interfaces, and application interactions. This framework is widely used across various Android devices, making it a significant target for vulnerabilities that could affect a large number of users.
Vulnerability Detail
In the isInSignificantPlace function of multiple files within the Android Platform Frameworks Base, there exists a vulnerability due to a missing permission check. This oversight allows unauthorized access to sensitive information, leading to potential local information disclosure. The vulnerability does not require additional execution privileges or user interaction for exploitation, making it particularly concerning for users and developers alike.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-22430 vulnerability in the Android Platform Frameworks Base poses a serious risk of local information disclosure due to a missing permission check. It is crucial for developers and users to apply the recommended patch to secure their applications and protect sensitive information.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-22430 is a vulnerability in the Android Platform Frameworks Base that allows unauthorized access to sensitive information due to a missing permission check.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to local information disclosure, allowing unauthorized users to access sensitive data without needing additional privileges.
No, user interaction is not needed for exploitation, making it a significant risk for users.
Update the Android Platform Frameworks Base to the patched version as soon as it is available to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
