CVE-2025-22426 Overview
CVE-2025-22426 is a local privilege escalation vulnerability in Google Android. The flaw exists in multiple functions of ComputerEngine.java, where a logic error allows access to URIs across user profiles. Exploitation requires local code execution with low privileges but no user interaction. A successful attack yields high impact to confidentiality, integrity, and availability on the affected device. The vulnerability falls under [CWE-284] Improper Access Control and affects Android versions 14, 15, and 16, including QPR2 beta builds.
Critical Impact
A local attacker can bypass Android's multi-user isolation model to access URIs belonging to other users, escalating privileges without additional execution rights or user interaction.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)
Discovery Timeline
- 2026-06-01 - CVE-2025-22426 published to NVD alongside the Android Security Bulletin
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2025-22426
Vulnerability Analysis
The vulnerability resides in ComputerEngine.java, a core component of Android's PackageManager subsystem that resolves package and provider metadata. Multiple functions in this class enforce access decisions on Uniform Resource Identifiers (URIs) that should remain isolated between Android user profiles. A logic error in these access checks allows a local app running as one user to reference URIs owned by another user on the same device.
Android uses URIs to broker access to content providers, files, and inter-process resources. The multi-user model depends on PackageManager correctly attributing each URI request to its calling user identity. When the access check fails to enforce that boundary, an attacker holding standard app permissions can request content that should be scoped to a separate profile. The result is a local escalation of privilege without requiring additional execution privileges.
Root Cause
The root cause is improper access control [CWE-284] in cross-user URI resolution logic. The affected functions in ComputerEngine.java do not consistently validate the caller's user identity against the URI's owning user before granting access.
Attack Vector
Exploitation requires a malicious or compromised app already installed on the device. The attacker app invokes the vulnerable URI resolution paths to read or interact with resources belonging to another user profile. No user interaction is required, and the attack proceeds entirely on the local device. Refer to the Android Security Bulletin June 2026 for technical details on affected code paths.
Detection Methods for CVE-2025-22426
Indicators of Compromise
- Installed applications issuing ContentResolver queries that reference user IDs outside the calling app's profile
- Unexpected access to content provider URIs across the multi-user boundary recorded in Android logcat
- Apps requesting INTERACT_ACROSS_USERS behavior without holding the corresponding permission
Detection Strategies
- Monitor PackageManager and ContentResolver logs for cross-user URI resolution attempts originating from non-system apps
- Inspect installed third-party APKs for code paths that invoke ComputerEngine resolution APIs with non-default user handles
- Audit enterprise managed devices for apps that interact with the work profile boundary outside documented APIs
Monitoring Recommendations
- Enroll Android fleet devices in a Mobile Threat Defense (MTD) solution that flags privilege escalation behavior and abnormal IPC patterns
- Forward Android system logs to a centralized SIEM for cross-user access anomaly analysis
- Track Android patch level (ro.build.version.security_patch) across the fleet to confirm devices receive the June 2026 security patch level or later
How to Mitigate CVE-2025-22426
Immediate Actions Required
- Apply the June 2026 Android security patch level (2026-06-01 or later) on all managed devices
- Prioritize updates for devices using work profiles or multi-user configurations, where cross-user isolation is part of the security model
- Restrict sideloading and enforce installs from vetted sources via enterprise mobility management policy
Patch Information
Google addressed CVE-2025-22426 in the June 2026 Android Security Bulletin. Devices must report a security patch level of 2026-06-01 or later to include the fix. Refer to the Android Security Bulletin June 2026 for OEM-specific patch availability.
Workarounds
- No vendor-supplied workaround exists; patching is the only complete mitigation
- Reduce risk by removing untrusted applications and limiting use of secondary user profiles on unpatched devices
- Enforce Google Play Protect and restrict installation of apps from unknown sources via MDM policy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
