CVE-2025-26417: DownloadProvider Bypass of User Consent Vulnerability
Summary
CVE-2025-26417: In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. Affects platform/packages/providers/DownloadProvider across 6 version ranges.
>= 12:0, < 12:2025-03-01
>= 12L:0, < 12L:2025-03-01
>= 13:0, < 13:2025-03-01
>= 14:0, < 14:2025-03-01
>= 15:0, < 15:2025-03-01
>= 15-next:0, < 15-next:2025-03-01
Fixed in 15-next:2025-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DownloadProvider package in Android is responsible for managing file downloads and providing access to downloaded files. It allows applications to download files from the internet and share them with other apps. This package is crucial for ensuring that users can easily manage their downloads while maintaining security and privacy. However, a recent vulnerability has been identified that could potentially compromise user consent when accessing files in shared storage.
Vulnerability Detail
In the method checkWhetherCallingAppHasAccess of DownloadProvider.java, there exists a flaw that allows a bypass of user consent when opening files in shared storage. This vulnerability arises from a confused deputy problem, where an application may gain unauthorized access to files without the user's explicit consent. The implications of this vulnerability include local information disclosure, which could expose sensitive user data without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
15-next:2025-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2025-26417 vulnerability in the DownloadProvider package poses a significant risk by allowing unauthorized access to files in shared storage without user consent. It is crucial for developers to apply the necessary patches to safeguard user data and maintain application integrity.
See every vulnerability recorded for platform/packages/providers/DownloadProvider →
FAQ
CVE-2025-26417 is a vulnerability in the DownloadProvider package of Android that allows a bypass of user consent when accessing files in shared storage.
The vulnerability can lead to local information disclosure, potentially exposing sensitive user data without their consent.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
Update the package to the patched version according to the Android version you are using. Refer to the 'how_to_fix' section for specific version updates.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/DownloadProvider.
