CVE-2025-32323 Overview
CVE-2025-32323 is an input validation flaw in the Android DocumentsUI component. The vulnerability resides in the getCallingAppName function of Shared.java, which fails to properly sanitize app-provided display names. Attackers can inject deceptive text into permission popups to trick users into granting file access. Google addressed the issue in the September 2025 Android Security Bulletin. The flaw affects Android versions 13, 14, 15, and 16.
Critical Impact
A local malicious application can spoof identity strings in file-access consent dialogs, leading to privilege escalation without requiring additional execution privileges.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15 and 16
Discovery Timeline
- 2025-09-04 - CVE-2025-32323 published to NVD
- 2025-09-01 - Fix included in Android Security Bulletin September 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32323
Vulnerability Analysis
The defect exists in the getCallingAppName method of Shared.java within the Android DocumentsUI package. This method retrieves the display name of the app that invoked a file-picker or storage-access intent. DocumentsUI then renders that name inside a permission consent dialog shown to the user.
Because the returned string is not properly validated or constrained, a malicious app can supply a crafted label containing misleading text, control characters, or impersonation content. The permission popup renders this attacker-controlled string as if it were trusted system context. Users can be deceived into approving file access under false pretenses, resulting in local escalation of privilege. The weakness maps to [CWE-20: Improper Input Validation].
Root Cause
The root cause is missing sanitization of caller-controlled display text before it is embedded in a security-relevant UI dialog. Android trusts the calling package to supply a truthful label, and DocumentsUI does not enforce length limits, character filtering, or origin indication. This design allows an application-supplied string to alter the semantic meaning of the consent prompt.
Attack Vector
Exploitation requires a malicious app already installed on the device. The app initiates a document access intent handled by DocumentsUI and provides a crafted application name. When DocumentsUI displays the resulting permission dialog, the injected text mimics a trusted app, system component, or additional instructions. The user grants access believing the request originates from a legitimate source. The attacker then obtains file access it would not have received under a truthful prompt. Notably, user interaction with the malicious app itself is not required beyond the standard consent tap.
See the Android UI Code Repository for the corrective commit.
Detection Methods for CVE-2025-32323
Indicators of Compromise
- Installed applications whose declared android:label contains unusual formatting, Unicode control characters, or text resembling system prompts.
- DocumentsUI consent events followed by unexpected access to shared storage, media collections, or Storage Access Framework URIs.
- Applications repeatedly invoking ACTION_OPEN_DOCUMENT, ACTION_OPEN_DOCUMENT_TREE, or ACTION_CREATE_DOCUMENT intents shortly after installation.
Detection Strategies
- Inspect the android:label attribute of installed packages for excessive length, embedded newlines, or impersonation strings referencing Google, Android System, or trusted vendors.
- Correlate DocumentsUI grant events in logcat and MediaProvider audit logs with the package that initiated the request.
- Use mobile threat defense telemetry to flag apps that request Storage Access Framework consent within seconds of first launch.
Monitoring Recommendations
- Track Android patch level across the fleet and alert on devices below the 2025-09-01 security patch level.
- Monitor enterprise mobility management (EMM) inventories for sideloaded APKs and unusual package labels.
- Review permission grants to non-store applications during periodic access recertification.
How to Mitigate CVE-2025-32323
Immediate Actions Required
- Apply the Android security patch level 2025-09-01 or later on all managed devices.
- Restrict installation of applications from unknown sources through EMM policy.
- Audit granted Storage Access Framework permissions and revoke any not tied to a business-approved app.
Patch Information
Google published the fix in the Android Security Bulletin September 2025. The source change is available in the Android UI Code Repository. Device OEMs distribute the fix through their respective monthly security updates. Users should install the update through Settings → System → Software update once made available by the device vendor or carrier.
Workarounds
- Deny file access requests from applications whose displayed name appears inconsistent with the launching app.
- Limit installed applications to vetted publishers via Google Play Protect and managed Google Play.
- Use work profile separation to isolate corporate documents from personal or untrusted applications until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
