PT-2025-24453 · Google · Android

Published 2025-05-01 · Updated 2025-09-05 · CVE-2025-26420

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The vulnerability resides within the System component of the Android operating system, stemming from improper code generation management. Remote attackers can potentially execute arbitrary code by exploiting this issue. Additionally, multiple functions within GrantPermissionsActivity.java may mislead users into granting incorrect permissions due to permission overload, potentially leading to local privilege escalation without requiring additional execution privileges. Exploitation does not require user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Code Injection

Weakness Enumeration

CWE-281

CWE-94

Related Identifiers

ASB-A-313909156

BDU:2025-06592

CVE-2025-26420

Affected Products

Android

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-26420 · Security Note
• https://source.android.com/security/bulletin/2025-05-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-313909156 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26420 · Vendor Advisory
• https://android.googlesource.com/platform/packages/modules/Permission/+/6bed47f63ec0600b3c57388449db37405c68dc58 · Patch
• https://bdu.fstec.ru/vul/2025-06592 · Security Note
• https://twitter.com/CVEnew/status/1963655980585009226 · Twitter Post
• https://source.android.com/docs/security/bulletin/2025-05-01?hl=en · Note
• https://t.me/cveNotify/134486 · Telegram Post