CVE-2025-26425: Permission Squatting Vulnerability in Android Permission Module
Summary
CVE-2025-26425: In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. Affects platform/packages/modules/Permission across 3 version ranges.
>= 14:0, < 14:2025-05-01
>= 15:0, < 15:2025-05-01
>= 15-next:0, < 15-next:2025-05-01
Fixed in 15-next:2025-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Permission module is a critical component of the Android operating system that manages permissions for applications. It ensures that apps can only access resources and data that they are authorized to use. This module plays a vital role in maintaining user privacy and security by enforcing permission checks. However, a recent vulnerability has been identified that could allow unauthorized privilege escalation under certain conditions.
Vulnerability Detail
In multiple functions of RoleService.java, a logic error has been discovered that leads to a permission squatting vulnerability. This flaw allows local escalation of privilege on Android versions where the android.permission.MANAGE_DEFAULT_APPLICATIONS is not defined with additional execution privileges. The vulnerability does not require user interaction for exploitation, making it particularly concerning for device security.
How To Fix
Minimum fixed version
15-next:2025-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2025-26425 vulnerability in the Android Permission module poses a significant risk of local privilege escalation. It is essential for developers and users to update their applications to the patched versions to ensure security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application integrity.
See every vulnerability recorded for platform/packages/modules/Permission →
FAQ
CVE-2025-26425 is a vulnerability in the Android Permission module that allows local escalation of privilege due to a logic error in the code.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating your application to the patched version as soon as possible.
More information can be found in the Android Open Source Vulnerability database at https://storage.googleapis.com/android-osv/ASB-A-379362792.json.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Permission.
