CVE-2025-0086 Overview
CVE-2025-0086 is a missing authorization vulnerability in the Android AccountManagerService.java component. The flaw resides in the onResult method, which fails to perform a required permission check before processing account authentication tokens. A local attacker can exploit this weakness to overwrite an existing auth token, leading to local information disclosure. Exploitation requires no user interaction and no elevated privileges. Google addressed the issue in the March 2025 Android Security Bulletin. The vulnerability is tracked under [CWE-862: Missing Authorization].
Critical Impact
A local application can overwrite authentication tokens managed by AccountManagerService without holding the appropriate permission, exposing sensitive account credentials to unauthorized processes on the device.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2025-03-01 - Android Security Bulletin published with fix
- 2025-08-26 - CVE-2025-0086 published to NVD
- 2025-09-02 - Last updated in NVD database
Technical Details for CVE-2025-0086
Vulnerability Analysis
The vulnerability exists in the onResult callback of AccountManagerService.java, a core component in the Android framework that brokers access to user account credentials. The AccountManagerService is responsible for storing, retrieving, and updating authentication tokens used by applications to access online services such as email, cloud storage, and enterprise identity providers.
When onResult processes the response from an account authenticator, it writes the returned auth token back into the account database. The vulnerable code path does not verify that the caller holds the permission required to modify tokens belonging to the targeted account. A malicious local application can leverage this gap to overwrite tokens stored for other accounts, enabling unauthorized substitution of credentials.
Because the attack requires only local access and no user interaction, any installed application can trigger the code path. The impact is confidentiality loss through token disclosure, while integrity and availability of the system remain unaffected.
Root Cause
The root cause is a missing permission check [CWE-862] in the onResult method. The method trusts the result payload returned from the account authenticator without enforcing that the invoking process has the AUTHENTICATE_ACCOUNTS or equivalent permission for the target account type. The upstream fix introduces the missing authorization check before the token is written.
Attack Vector
A local attacker installs or controls an application on the target device. The application invokes AccountManager APIs that cause AccountManagerService.onResult to be triggered with attacker-controlled values. Because the permission check is missing, the service accepts the attacker-supplied auth token and overwrites the legitimate one. The attacker then reads the token from the account store, achieving local information disclosure.
No verified public proof-of-concept code is available. For technical details of the fix, refer to the Android Source Code Commit and the Android Security Bulletin March 2025.
Detection Methods for CVE-2025-0086
Indicators of Compromise
- Unexpected modifications to entries under the Android accounts database (/data/system_ce/<user>/accounts_ce.db).
- Applications invoking AccountManager.setAuthToken or related APIs against account types they do not own.
- Authentication failures or token mismatches reported by legitimate apps following installation of an untrusted package.
Detection Strategies
- Audit installed applications on managed devices for unusual use of AccountManager APIs through Mobile Threat Defense or MDM telemetry.
- Monitor Android logcat events emitted by AccountManagerService for repeated onResult invocations from non-system UIDs.
- Correlate package install events with subsequent account token changes to identify suspicious sequences.
Monitoring Recommendations
- Enforce Android Security Patch Level reporting through enterprise mobility management and flag devices below the March 2025 patch level.
- Track sideloaded applications and applications requesting account-related permissions for review.
- Review backend authentication logs for token reuse or session anomalies that may indicate a stolen token from a compromised device.
How to Mitigate CVE-2025-0086
Immediate Actions Required
- Apply the March 2025 Android security patch or later on all affected devices running Android 12.0 through 15.0.
- Inventory devices through MDM and quarantine those that cannot receive the patch.
- Restrict installation of applications from untrusted sources via enterprise policy.
Patch Information
Google released the fix as part of the March 2025 Android Security Bulletin with patch level 2025-03-01. The upstream code change is published in the Android Source Code Commit. Device manufacturers integrate the fix into their respective monthly security update rollouts. Refer to the Android Security Bulletin March 2025 for the full advisory and patched build numbers.
Workarounds
- Limit account types provisioned on the device to those strictly required for business use.
- Deploy a Mobile Threat Defense agent to detect malicious or sideloaded applications attempting to interact with AccountManager.
- Disable installation from unknown sources and require enterprise app store distribution until patches are applied.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-03-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
