CVE-2026-0025: Android Framework Base - Information Disclosure via Permissions Bypass
Summary
CVE-2026-0025: In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2:0, < 16-qpr2:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework Base is a core component of the Android operating system, providing essential functionalities for app development and system operations. It includes classes and methods that manage notifications, user interfaces, and system interactions. This package is critical for ensuring smooth operations across various Android applications, but it is also susceptible to vulnerabilities that can compromise user data and system integrity.
Vulnerability Detail
In the hasImage method of Notification.java, a permissions bypass vulnerability exists that allows unauthorized information disclosure across user accounts. This flaw can lead to local privilege escalation without requiring additional execution privileges or user interaction, potentially exposing sensitive user data to malicious actors.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected methods in your application until the update is applied. This can be done by implementing additional permission checks or by disabling features that rely on the hasImage method until the patch is deployed.
Conclusion
The CVE-2026-0025 vulnerability in the Android Framework Base poses a significant risk due to its potential for unauthorized information disclosure. It is crucial for developers to update their packages to the patched version to mitigate these risks and protect user data.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0025 is a vulnerability in the Android Framework Base that allows unauthorized access to user information due to a permissions bypass.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your gradle.lockfile for vulnerabilities.
The risks include potential unauthorized access to sensitive user data and local privilege escalation, which can compromise user privacy and security.
No, user interaction is not needed for exploitation, making it more critical to address promptly.
If immediate updates are not possible, implement temporary workarounds such as restricting access to affected methods until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
