CVE-2025-22442 Overview
CVE-2025-22442 is a race condition vulnerability in the Android DevicePolicyManagerService.java component. The flaw allows an attacker to install unauthorized applications into a newly created work profile. Google tracks this issue in the April 2025 Android Security Bulletin, and it affects Android 13, 14, and 15.
Exploitation requires local access and low privileges, but no user interaction. Successful exploitation results in local privilege escalation without additional execution privileges. The underlying weakness is classified as [CWE-362] concurrent execution using shared resource with improper synchronization.
Critical Impact
A local attacker can win a race in DevicePolicyManagerService to install unauthorized applications into a freshly provisioned work profile, escalating privileges without user interaction.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
Discovery Timeline
- 2025-09-02 - CVE-2025-22442 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22442
Vulnerability Analysis
The vulnerability resides in multiple functions of DevicePolicyManagerService.java, the Android framework service that manages device and profile ownership. During the creation of a new work profile, several code paths access shared state without adequate synchronization. An attacker with local code execution can time operations to interleave with the profile provisioning flow.
The race window allows an unauthorized application to be installed into the work profile before policy enforcement completes. Because the work profile inherits managed status, the injected application obtains privileges tied to that profile context. The result is a local privilege escalation.
The vulnerability is limited to devices running Android 13, 14, and 15 that support work profile provisioning through DevicePolicyManager. Google's fix modifies the affected code paths in the Android Open Source Project (AOSP) frameworks/base repository under commit 2095d130b4d7f2ba1a3284abb58ca894817f5f4a.
Root Cause
The root cause is improper synchronization across concurrent operations in DevicePolicyManagerService. Shared state related to work profile creation and application installation is not guarded consistently. This produces a Time-of-Check to Time-of-Use (TOCTOU) condition that an attacker can trigger during profile provisioning.
Attack Vector
The attack vector is local. A malicious application already present on the device must run concurrently with the work profile creation flow. By timing installation requests against the provisioning sequence, the attacker inserts an unauthorized application into the new profile. No user interaction is required after the initial application presence.
See the Android Source Code Change for the exact functions modified in the patch.
Detection Methods for CVE-2025-22442
Indicators of Compromise
- Unexpected applications appearing inside a work profile immediately after provisioning completes.
- Installation events for packages that were not requested by the enterprise mobility management (EMM) or device policy controller.
- Concurrent installPackage or PackageInstaller sessions occurring during DevicePolicyManager profile creation calls.
Detection Strategies
- Monitor Android system logs (logcat) for DevicePolicyManagerService transitions overlapping with package installation events.
- Correlate work profile creation timestamps with subsequent package install audit records from mobile device management (MDM) telemetry.
- Flag any package installed into a work profile that is not present in the EMM-approved application catalog.
Monitoring Recommendations
- Ingest MDM and Android Enterprise audit logs into a centralized SIEM for correlation across devices.
- Alert on work profile creation events followed by non-approved package installs within a short time window.
- Track Android security patch level compliance across the mobile fleet to identify devices still vulnerable to CVE-2025-22442.
How to Mitigate CVE-2025-22442
Immediate Actions Required
- Apply the April 2025 Android security patch level or later to all managed Android 13, 14, and 15 devices.
- Enforce minimum patch level policies through MDM so non-compliant devices lose access to managed resources.
- Audit existing work profiles for unauthorized applications installed prior to patching.
Patch Information
Google addressed CVE-2025-22442 in the Android Security Bulletin April 2025. The corresponding AOSP fix is committed to platform/frameworks/base at revision 2095d130b4d7f2ba1a3284abb58ca894817f5f4a. Device manufacturers should pull the patch and ship a security patch level of 2025-04-01 or later.
Workarounds
- Restrict application installation to vetted sources by disabling installation from unknown sources on managed devices.
- Limit which users can create work profiles through MDM policy until the patch is deployed.
- Remove untrusted applications from personal profiles on devices that also host managed work profiles.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-04-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
