CVE-2025-26436 Overview
CVE-2025-26436 is a Background Activity Launch (BAL) bypass vulnerability in the Android framework, specifically within the clearAllowBgActivityStarts method of PendingIntentRecord.java. The flaw allows a local application to launch an activity from the background without holding the privileges normally required. Exploitation requires no user interaction and no additional execution privileges beyond those of an installed app. Google addressed the issue in the Android Security Bulletin May 2025. The vulnerability affects Android 13, 14, and 15 and is classified under [CWE-863] (Incorrect Authorization).
Critical Impact
A local application can bypass Background Activity Launch restrictions to escalate privileges on Android 13, 14, and 15 devices without user interaction.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0
Discovery Timeline
- 2025-09-04 - CVE-2025-26436 published to NVD
- 2025-05-01 - Fix included in the Android Security Bulletin May 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26436
Vulnerability Analysis
Android enforces Background Activity Launch (BAL) restrictions to prevent apps from starting activities while they are not in the foreground. These restrictions block a common vector for tapjacking, UI spoofing, and stealth privilege escalation. PendingIntentRecord tracks whether a given pending intent is allowed to bypass those restrictions when it is later sent.
The clearAllowBgActivityStarts method is responsible for revoking that permission once the associated whitelist token is no longer valid. The vulnerable implementation does not correctly clear the allow-background-activity-starts state in every path. A local attacker with an installed application can craft a sequence of pending intent operations that leaves the BAL allowance set even after it should have been revoked.
When the pending intent is subsequently triggered, the system honors the stale allowance and launches an activity from the background. This grants the attacking app the ability to display UI or execute code paths reserved for foreground applications, enabling local privilege escalation.
Root Cause
The root cause is an authorization state-management error in PendingIntentRecord.clearAllowBgActivityStarts. The method fails to fully clear the token-based allowance under specific conditions, resulting in incorrect authorization ([CWE-863]) when the pending intent is later delivered.
Attack Vector
Exploitation is local. A malicious application installed on the device registers a pending intent, manipulates its whitelist token lifecycle to trigger the incomplete-clearing path, and then delivers the intent to launch an activity while backgrounded. No user interaction and no elevated permissions are required.
No verified proof-of-concept code is publicly available. See the upstream fixes at commits bba26504 and ccba6717 for the corrected authorization logic.
Detection Methods for CVE-2025-26436
Indicators of Compromise
- Applications registering pending intents and rapidly cycling whitelist tokens through setAllowBgActivityStarts and clearAllowBgActivityStarts calls.
- Activities launching from applications that have been in a stopped or cached state without a preceding user gesture.
- Unexpected foreground activity transitions logged by ActivityTaskManager for apps that should be restricted by BAL.
Detection Strategies
- Review logcat output from ActivityTaskManager and PendingIntent for BAL Allowed decisions attributed to background apps.
- Baseline installed apps against known-good behavior and flag any package that triggers activity starts while its process importance is CACHED or SERVICE.
- Use Google Play Protect and enterprise mobile threat defense telemetry to identify apps abusing pending intent APIs.
Monitoring Recommendations
- Track the Android security patch level reported by managed devices and alert on any device below the 2025-05-01 patch level.
- Monitor MDM/EMM compliance feeds for out-of-date Android builds on Android 13, 14, and 15 fleets.
- Correlate app installation events with subsequent background-to-foreground activity transitions in mobile EDR telemetry.
How to Mitigate CVE-2025-26436
Immediate Actions Required
- Apply the Android security patch level 2025-05-01 or later to all Android 13, 14, and 15 devices.
- Instruct users on unmanaged devices to install the latest OEM security update as soon as it is available for their model.
- Restrict installation of applications from untrusted sources and enforce Google Play Protect on managed fleets.
- Audit enterprise app catalogs for applications that request SYSTEM_ALERT_WINDOW or aggressively use pending intents.
Patch Information
Google published the fix in the Android Security Bulletin May 2025. The corrected PendingIntentRecord behavior is implemented in AOSP commits bba26504af51d2dd3b8eddeb96e59cac8fcb9070 and ccba6717779fea0a86b6326f9925c36fc837738c. Device OEMs distribute the fix through their monthly security update channels.
Workarounds
- No official workaround exists. Enforce the 2025-05-01 or later security patch level through mobile device management policy.
- On managed devices, block sideloading and restrict installations to vetted enterprise app stores until patches are confirmed.
- Retire or replace devices whose OEMs no longer ship security updates for Android 13 or later.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
