CVE-2025-32320: Google Android Privilege Escalation Flaw

CVE-2025-32320 Overview

CVE-2025-32320 is a local privilege escalation vulnerability in the Android System UI component. The flaw stems from a confused deputy condition that allows a local application to view images belonging to other users on the same device. Google Android 16.0 is affected according to the security bulletin. Exploitation requires no user interaction and no additional execution privileges beyond those already held by a local unprivileged app. The weakness is tracked as [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)].

Critical Impact
A local attacker can leverage System UI as a confused deputy to access private images owned by other Android users on the same device, breaking the multi-user isolation model.

Affected Products

Google Android 16.0
Android System UI component
Multi-user Android device deployments

Discovery Timeline

2025-09-05 - CVE-2025-32320 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32320

Vulnerability Analysis

The vulnerability resides in the Android System UI, a privileged system component that renders shared user-interface surfaces such as the status bar, notifications, and media pickers. System UI operates with elevated privileges and can access resources across multiple user profiles on the device. A local application can invoke System UI in a way that causes it to act on the attacker's behalf against another user's image data. Because System UI performs the access using its own privileges rather than the caller's, the operating system's user-isolation checks are bypassed. The outcome is unauthorized disclosure of image content belonging to secondary users, work profiles, or the device owner.

Root Cause

The root cause is a confused deputy pattern [CWE-441]. System UI accepts a request from a lower-privileged caller and services that request using its own cross-user permissions without validating whether the caller is authorized to read the target user's images. The missing authorization check between the caller identity and the target resource enables the escalation.

Attack Vector

Exploitation is local. An installed application on the device crafts an inter-process request to System UI that references image resources scoped to another user. System UI resolves and returns the image content back to the caller. No user interaction, additional permissions, or elevated execution context are required. Verified proof-of-concept code is not publicly available in the referenced advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Android Security Bulletin for component-level details.

Detection Methods for CVE-2025-32320

Indicators of Compromise

Unexpected inter-process communication from third-party applications to the Android System UI process targeting image or media content providers.
Cross-user content URI access requests originating from applications that lack INTERACT_ACROSS_USERS or INTERACT_ACROSS_USERS_FULL permissions.
Anomalous read activity against media storage paths associated with non-primary user profiles.

Detection Strategies

Monitor Android audit logs and logcat output for System UI mediating content access on behalf of unprivileged callers.
Correlate application binder transactions with the target user ID to identify requests that cross user boundaries.
Use mobile threat defense telemetry to flag applications enumerating other users' media content providers.

Monitoring Recommendations

Track installation of unvetted third-party applications on devices with multiple user profiles or work profiles enabled.
Alert on applications requesting media content from user IDs other than the caller's own.
Review enterprise mobility management (EMM) reports for devices missing the Android 16 security patch that addresses this CVE.

How to Mitigate CVE-2025-32320

Immediate Actions Required

Apply the Android security patch referenced in the Android Security Bulletin to affected devices.
Inventory devices running Android 16.0 and prioritize patch deployment through the mobile device management platform.
Restrict installation of untrusted applications on shared or multi-user devices until patches are applied.

Patch Information

Google addressed the confused deputy condition in the System UI component as documented in the Android Security Bulletin for Android 16. Device manufacturers distribute the fix through vendor-specific security patch levels. Confirm that affected endpoints report a security patch level dated on or after the bulletin's release.

Workarounds

Disable secondary users and work profiles on shared devices where feasible until patching completes.
Enforce an application allowlist through mobile device management to reduce the pool of potentially malicious local callers.
Educate users on installing applications only from trusted sources such as Google Play with Play Protect enabled.

bash

# Verify Android security patch level on a managed device via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release