CVE-2025-26454: Android Privilege Escalation Vulnerability

CVE-2025-26454 Overview

CVE-2025-26454 is a local privilege escalation vulnerability in Google Android's ManagedProvisioning application. The flaw resides in the validateUriSchemeAndPermission method of DisclaimersParserImpl.java. A confused deputy condition allows a local attacker to access data belonging to another user on the device. Exploitation requires no user interaction and no additional execution privileges beyond a low-privileged local context. The issue affects Android 13, 14, and 15, and is addressed in the Android Security Bulletin for September 2025.

Critical Impact
A local attacker can escalate privileges and read data from other user profiles on the device without user interaction.

Affected Products

Google Android 13
Google Android 14
Google Android 15

Discovery Timeline

2025-09-01 - Fix published in the Android Security Bulletin for September 2025
2025-09-04 - CVE-2025-26454 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26454

Vulnerability Analysis

The vulnerability lives in DisclaimersParserImpl.java inside Android's ManagedProvisioning package. This package runs as a privileged system component and handles device and profile provisioning flows, including parsing disclaimer content supplied through provisioning intents.

The validateUriSchemeAndPermission method fails to correctly validate URIs referencing content from other users. Because ManagedProvisioning operates with elevated permissions, an attacker-controlled process can pass a crafted URI and cause the privileged component to read data on its behalf. This behavior matches the pattern classified as [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)].

Root Cause

The root cause is insufficient URI scheme and permission validation. ManagedProvisioning acts as a deputy that resolves content URIs while holding privileges the caller does not possess. When the validation logic accepts URIs pointing to another user's data, the privileged component becomes an implicit bridge across the Android multi-user boundary.

Attack Vector

Exploitation is local. An attacker with a low-privileged app on the device sends a provisioning-related intent carrying a URI that targets another user's content provider. ManagedProvisioning resolves the URI using its own permissions and returns or processes data the attacker's app should not be able to reach. No user interaction is required. See the Android Security Bulletin September 2025 and the source commits 03cadb65 and d33d0454 for the corrective changes.

Detection Methods for CVE-2025-26454

Indicators of Compromise

Unexpected invocations of ManagedProvisioning provisioning intents from non-administrator apps.
Anomalous cross-user content URI resolutions logged by system components.
Third-party applications requesting provisioning flows without a legitimate device management use case.

Detection Strategies

Review Android device logs (logcat) for ManagedProvisioning disclaimer parsing events tied to unusual caller UIDs.
Use mobile threat defense telemetry to flag apps that construct provisioning intents referencing content URIs across user IDs.
In managed fleets, alert on installation of apps that target provisioning APIs but are not enrolled device policy controllers.

Monitoring Recommendations

Track Android patch level compliance and flag devices below the September 2025 security patch level.
Monitor enterprise MDM inventory for Android 13, 14, and 15 endpoints that have not received the vendor OTA update.
Correlate abnormal cross-profile data access patterns with app install and provisioning intent events.

How to Mitigate CVE-2025-26454

Immediate Actions Required

Apply the September 2025 Android security patch level (or later) to all Android 13, 14, and 15 devices.
Enforce minimum patch level policies via MDM to block noncompliant devices from accessing enterprise resources.
Restrict sideloading and limit installation of untrusted applications on multi-user devices.

Patch Information

Google addressed the vulnerability in ManagedProvisioning through commits 03cadb65c0b6a91a480041aa9129e9dbf995279b and d33d045407c5bd0000442667d9ef5c9fc3f590e5, tightening URI scheme and permission checks in DisclaimersParserImpl. Fixes are shipped in the Android Security Bulletin September 2025. OEM release timing varies; consult the device manufacturer for firmware availability.

Workarounds

Avoid configuring multiple user profiles on unpatched Android 13, 14, and 15 devices where feasible.
Remove untrusted third-party applications until the vendor patch is installed.
Require managed devices to report a security patch level of 2025-09-01 or later before granting access to sensitive corporate data.

bash

# Configuration example: verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-01 or later