CVE-2025-32326: Android Settings App Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2025-32326: In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. Affects platform/packages/apps/Settings across 5 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Settings application is a core component of the Android operating system, responsible for managing device settings and user preferences. It provides a user-friendly interface for configuring various system functionalities, including network settings, user accounts, and application permissions. This application is crucial for maintaining device security and user experience. However, vulnerabilities within this app can lead to significant security risks, including unauthorized access to sensitive features.
Vulnerability Detail
In multiple functions of AppRestrictionsFragment.java, there exists a vulnerability that allows a bypass of intent security checks due to a confused deputy scenario. This flaw can lead to local escalation of privilege, enabling an attacker to gain unauthorized access to restricted functionalities without needing additional execution privileges. Exploitation of this vulnerability requires user interaction, making it a potential risk for users who may inadvertently trigger the exploit.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-32326 vulnerability in the Android Settings application poses a significant risk of local privilege escalation. Users are encouraged to update their applications promptly to mitigate potential security threats. Regular monitoring and updates are essential for maintaining device security.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
CVE-2025-32326 is a vulnerability in the Android Settings application that allows local privilege escalation due to a bypass of intent security checks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If your device is affected, ensure to update the Android Settings application to the latest patched version as soon as it is available.
Yes, user interaction is needed for exploitation, which means that an attacker would need the user to perform specific actions to trigger the vulnerability.
More information can be found in the official Android security bulletins and on vulnerability databases such as Vulert.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
