CVE-2025-26418 Overview
CVE-2025-26418 is a local privilege escalation vulnerability in Google Android affecting the CarDevicePolicyService component used in Android Automotive deployments. The flaw resides in the setUserDisclaimerAcknowledged method, which lacks a required permission check. An attacker with local access can bypass the user dialog that normally gates adding an account to a managed device. The weakness is classified as [CWE-862] Missing Authorization. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the June 2026 Android Security Bulletin.
Critical Impact
A local application can silently acknowledge the managed-device user disclaimer and add accounts to a managed automotive device, leading to local escalation of privilege without user interaction.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Android Automotive deployments using CarDevicePolicyService
Discovery Timeline
- 2026-06-01 - Google publishes fix in the Android Security Bulletin for June 2026
- 2026-06-01 - CVE-2025-26418 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2025-26418
Vulnerability Analysis
The vulnerability exists in CarDevicePolicyService.java, a system service that enforces device policy on Android Automotive systems. The setUserDisclaimerAcknowledged method records that a user has acknowledged the managed-device disclaimer presented when adding an account. This acknowledgement gates account provisioning on managed devices. Because the method omits a caller permission check, any local app can invoke it directly and mark the disclaimer as acknowledged. The result is a workflow bypass that suppresses the consent dialog before an account is added to the managed device.
Root Cause
The root cause is a missing authorization check on a privileged service entry point. setUserDisclaimerAcknowledged does not verify that the calling UID holds a device-policy or system-level permission. Without that check, the method trusts any caller and updates the acknowledgement state. This is a classic [CWE-862] Missing Authorization pattern in an Android system service.
Attack Vector
Exploitation is local. A malicious application installed on the Android Automotive device binds to CarDevicePolicyService and calls setUserDisclaimerAcknowledged through the exposed binder interface. The service updates the acknowledgement flag without validating the caller, allowing subsequent account-addition flows to proceed without showing the user dialog. The attacker gains the ability to manipulate managed account state that should require explicit user consent.
No verified proof-of-concept code is publicly available. Refer to the Android Security Bulletin June 2026 for vendor technical details.
Detection Methods for CVE-2025-26418
Indicators of Compromise
- Unexpected calls from non-system UIDs to CarDevicePolicyService binder transactions, particularly setUserDisclaimerAcknowledged.
- Accounts added to a managed automotive device without the corresponding user-disclaimer dialog appearing in UI traces.
- Installation of unverified third-party APKs on Android Automotive head units running Android 14 or 15.
Detection Strategies
- Audit logcat and dumpsys car_device_policy_service output for acknowledgement state changes that do not correlate with user-facing dialog events.
- Monitor binder traffic to car_device_policy_service for invocations originating from non-privileged application UIDs.
- Inventory installed packages on managed devices and flag any APK requesting access to car management APIs without a legitimate enterprise enrollment.
Monitoring Recommendations
- Enable enterprise device-policy logging on managed Android Automotive deployments and forward events to a centralized analytics pipeline.
- Track Android security patch level (SPL) across the fleet and alert on devices remaining below the June 2026 patch level.
- Correlate new account additions with their originating process and user-consent telemetry to identify silent provisioning.
How to Mitigate CVE-2025-26418
Immediate Actions Required
- Apply the June 2026 Android Security Bulletin update to all Android 14 and Android 15 devices, prioritizing Android Automotive head units.
- Restrict sideloading and enforce Play Protect or equivalent app vetting on managed automotive devices.
- Review installed applications on affected devices and remove any that are unsigned, unverified, or not required for vehicle operation.
Patch Information
Google released the fix in the Android Security Bulletin June 2026. Devices must report a security patch level of 2026-06-01 or later to be considered remediated. OEM and carrier rollouts may vary; coordinate with the device vendor for Automotive OS image availability.
Workarounds
- Limit physical and ADB access to Android Automotive systems until the patch is deployed.
- Use mobile device management (MDM) policies to restrict installation of non-approved applications on managed devices.
- Disable account addition workflows on managed automotive profiles where business requirements allow.
# Verify the security patch level on an affected device
adb shell getprop ro.build.version.security_patch
# Expected output after remediation: 2026-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
