CVE-2025-26464: AppSearch Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-26464: In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. Affects platform/packages/modules/AppSearch versions >= 15:0, < 15:2025-09-01. Fixed in 15:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AppSearch package is a component of the Android operating system that provides search functionalities across applications. It allows developers to implement search features within their apps, enabling users to find content efficiently. However, this package has been identified to have a vulnerability that could potentially allow unauthorized background activity launches, leading to security risks.
Vulnerability Detail
In the executeAppFunction method of AppSearchManagerService.java, there exists a logic error that can lead to a background activity launch without proper authorization. This vulnerability allows for local escalation of privilege, meaning an attacker could exploit this flaw to gain elevated access to system functions without needing additional execution privileges. User interaction is not required for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
15:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The CVE-2025-26464 vulnerability in the AppSearch package poses a significant risk due to its potential for local privilege escalation without user interaction. It is crucial for developers to update to the patched version to secure their applications against this vulnerability.
See every vulnerability recorded for platform/packages/modules/AppSearch →
FAQ
CVE-2025-26464 is a vulnerability in the AppSearch package that allows local privilege escalation due to a logic error in the code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
The vulnerability could allow unauthorized background activity launches, leading to potential security breaches and unauthorized access to sensitive data.
No, user interaction is not needed for exploitation, making it easier for an attacker to exploit the vulnerability.
Update the AppSearch package to the patched version as soon as it is available to mitigate the risk associated with this vulnerability.
