CVE-2025-26464: Google Android Privilege Escalation Flaw

CVE-2025-26464 Overview

CVE-2025-26464 is a local privilege escalation vulnerability in the Android AppSearchManagerService. The flaw exists in the executeAppFunction method, where a logic error allows unauthorized background activity launches. An attacker with local access and low privileges can exploit this weakness without user interaction. The vulnerability affects Google Android 15 and is classified under [CWE-693: Protection Mechanism Failure]. Google addressed the issue in the September 2025 Android Security Bulletin.

Critical Impact
Local applications can bypass background activity launch restrictions to escalate privileges, potentially gaining access to sensitive user data and system-level functionality without any user interaction.

Affected Products

Google Android 15.0
Devices running the AppSearch module prior to the September 2025 patch level
Android Open Source Project (AOSP) builds incorporating the vulnerable AppSearchManagerService.java

Discovery Timeline

2025-09-04 - CVE-2025-26464 published to the National Vulnerability Database (NVD)
2025-09-01 - Google publishes fix in the Android Security Bulletin September 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26464

Vulnerability Analysis

The vulnerability resides in the executeAppFunction method of AppSearchManagerService.java, part of the Android AppSearch module. AppSearch provides on-device indexing and search capabilities for applications. The executeAppFunction entry point allows callers to invoke registered application functions through the AppSearch service.

A logic error in this code path fails to correctly enforce background activity launch restrictions. Android normally blocks background processes from launching activities unless specific allowlist conditions are met. The flawed check in executeAppFunction permits a caller to trigger activity launches that should be denied by the platform's background activity launch policy.

The practical result is a local escalation of privilege. A malicious application already installed on the device can trigger activities belonging to more privileged contexts, effectively bypassing Android's process isolation boundaries. The confidentiality, integrity, and availability impact is high because the launched activity executes with the target component's permissions.

Root Cause

The root cause is a Protection Mechanism Failure ([CWE-693]) in the AppSearch service. The executeAppFunction handler does not properly validate the caller's authorization to initiate an activity launch on behalf of another component. The fix is implemented in commit e272ad0, which corrects the permission and context checks before dispatching the function call.

Attack Vector

Exploitation requires local access with low privileges, meaning a malicious or compromised application must already be running on the target device. No user interaction is required. The attacker's app invokes executeAppFunction with crafted parameters that trigger the flawed logic path, causing the AppSearch service to launch an activity that the caller could not otherwise start. The launched activity can then be used to access data or capabilities beyond the attacker's granted permissions.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-26464

Indicators of Compromise

Unexpected activity launches originating from applications that do not have foreground state or SYSTEM_ALERT_WINDOW-class permissions
Anomalous invocations of AppSearchManagerService.executeAppFunction from unprivileged UIDs in logcat output
Applications requesting AppSearch APIs with function names or arguments that do not match their declared functionality

Detection Strategies

Audit ActivityTaskManager logs for background activity launches that succeed despite the calling process being in a background state
Monitor Android application telemetry for use of AppSearchManager.executeAppFunction from third-party applications with no legitimate AppSearch integration
Review mobile threat defense (MTD) telemetry for anomalous inter-process communication patterns involving the com.google.android.appsearch package

Monitoring Recommendations

Enforce enterprise mobility management policies that require the September 2025 Android security patch level or later
Correlate application installation events with subsequent AppSearch API usage in security information and event management (SIEM) pipelines
Track device patch-level compliance in enterprise fleets and flag Android 15 devices lacking the 2025-09-01 patch level

How to Mitigate CVE-2025-26464

Immediate Actions Required

Apply the September 2025 Android security patch (patch level 2025-09-01 or later) to all Android 15 devices
Prioritize patching for devices in high-risk environments and those with sideloaded applications
Restrict installation of applications from untrusted sources through mobile device management (MDM) policy

Patch Information

Google released the fix in the Android Security Bulletin September 2025. The source-level correction is available in the AppSearch module at commit e272ad0. Device manufacturers distribute the fix through over-the-air (OTA) updates. Verify the security patch level under Settings > About phone > Android security update.

Workarounds

Limit device exposure by uninstalling unnecessary third-party applications until the patch is applied
Enforce Google Play Protect scanning to identify potentially harmful applications abusing AppSearch APIs
Use enterprise app allowlisting to prevent execution of untrusted applications on managed Android 15 devices

bash

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch

# Expected output for a patched device (or later date):
# 2025-09-01