CVE-2025-36889: CameraActivity Permission Bypass Vulnerability in Android
Summary
CVE-2025-36889: In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CameraActivity is a component of the Android operating system that manages camera functionalities for applications. It allows users to capture photos and videos, providing essential features for multimedia applications. However, this component is susceptible to a permission bypass vulnerability that could expose sensitive information without requiring additional privileges.
Vulnerability Detail
In the onCreateTasks method of CameraActivity.java, a permission bypass occurs due to a confused deputy problem. This vulnerability allows local information disclosure, meaning that an attacker could potentially access sensitive data without needing elevated privileges. The exploitation of this vulnerability does not require user interaction, making it particularly concerning for users of affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-36889 represents a significant security risk within the CameraActivity component of Android, allowing for a permission bypass that could lead to unauthorized access to sensitive information. Users are strongly encouraged to update their devices to the patched version to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36889 is a vulnerability in the CameraActivity component of Android that allows for a permission bypass, potentially leading to local information disclosure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By checking your gradle.lockfile, you can determine if your application is affected by this vulnerability.
No, user interaction is not needed for exploitation, making it a significant risk for users.
While there are no specific workarounds, it is crucial to apply the patch as soon as possible to mitigate the risk associated with this vulnerability.
You can find more details about CVE-2025-36889 in the official vulnerability database or by visiting Vulert's website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
