CVE-2025-26452: Android Frameworks Base Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-26452: In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. Affects platform/frameworks/base across 3 version ranges.
>= 14:0, < 14:2025-06-01
>= 15:0, < 15:2025-06-01
>= 16-next:0, < 16-next:2025-06-01
Fixed in 16-next:2025-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, responsible for providing essential services and APIs to applications. It facilitates resource management, UI rendering, and application lifecycle management. This package is critical for the stability and security of Android devices, making it a prime target for vulnerabilities that could compromise user data and system integrity.
Vulnerability Detail
In the ResourcesImpl.java file, specifically in the loadDrawableForCookie function, there exists a vulnerability that allows unauthorized access to task snapshots of other applications. This issue arises from a confused deputy problem, where the system mistakenly grants access to sensitive data without proper authorization checks. The ramifications of this vulnerability include potential local escalation of privileges, enabling an attacker to access private information from other applications without requiring additional execution privileges or user interaction.
How To Fix
Minimum fixed version
16-next:2025-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to update their systems as soon as the patch is available.
Conclusion
The CVE-2025-26452 vulnerability in the Android Frameworks Base package poses a significant risk of local privilege escalation, allowing unauthorized access to sensitive application data. It is crucial for users to update their systems to the patched version to mitigate this risk effectively.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-26452 is a vulnerability in the Android Frameworks Base package that allows unauthorized access to task snapshots of other applications, potentially leading to local privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is local privilege escalation, which could allow malicious applications to access sensitive data from other applications without user consent.
No, user interaction is not needed for exploitation, making it particularly dangerous.
You can update the package through your device's software update feature or by downloading the patched version from the official Android source repository.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
