CVE-2025-32324 Overview
CVE-2025-32324 is a local privilege escalation vulnerability in the Android Activity Manager. The flaw resides in the onCommand method of ActivityManagerShellCommand.java, where a confused deputy condition allows an attacker to launch arbitrary activities. Exploitation requires only local access with low privileges and no user interaction. The vulnerability affects Google Android versions 15.0 and 16.0. Google addressed the issue in the September 2025 Android Security Bulletin. The weakness maps to [CWE-441] (Unintended Proxy or Intermediary, or Confused Deputy).
Critical Impact
A local attacker can escalate privileges on affected Android devices by tricking a privileged component into launching activities on their behalf, all without user interaction.
Affected Products
- Google Android 15.0
- Google Android 16.0
- Android platform component: frameworks/base (Activity Manager)
Discovery Timeline
- 2025-09-04 - CVE-2025-32324 published to the National Vulnerability Database (NVD)
- 2025-09-01 - Google publishes fix in the Android Security Bulletin September 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32324
Vulnerability Analysis
The vulnerability exists in the onCommand method of ActivityManagerShellCommand.java, part of the Android system server. ActivityManagerShellCommand handles shell command invocations against the Activity Manager Service (AMS) and executes them with the system's privileges. When processing a command that starts an activity, the handler does not sufficiently verify the caller's authority relative to the activity being launched. A local application can therefore instruct the privileged system component to launch an activity that the caller itself would not be permitted to launch directly.
This is a classic confused deputy pattern [CWE-441]: the privileged deputy performs an action on behalf of a less-privileged principal without validating that the principal has the right to request it. The resulting arbitrary activity launch enables local privilege escalation without any additional execution privileges and without user interaction.
Root Cause
The root cause is missing or insufficient permission enforcement in the shell command dispatch path within ActivityManagerShellCommand. The upstream fix landed in the Android Open Source Project commit 0fb2788dac393086b7e53fbe05414368ae395d9b, which tightens caller identity handling in the affected code path.
Attack Vector
Exploitation requires local access with low privileges, such as a malicious application installed on the device. The application invokes the affected Activity Manager code path so that the system-privileged process launches an activity the attacker chose. Because the deputy runs with elevated privileges, the launched activity inherits capabilities the caller could not obtain directly, resulting in privilege escalation. No user interaction is required.
No public proof-of-concept exploit code is available for this vulnerability. Refer to the vendor commit and bulletin for technical remediation details.
Detection Methods for CVE-2025-32324
Indicators of Compromise
- Unexpected activity launches originating from system_server or the com.android.shell UID on behalf of third-party applications.
- Installed applications that invoke IActivityManager shell interfaces or repeatedly interact with am command surfaces from non-adb contexts.
- Newly launched privileged activities without a corresponding user-visible launcher event in system logs.
Detection Strategies
- Review logcat and ActivityTaskManager traces for activity starts where the launching UID differs from the target activity's expected caller.
- Inspect installed APKs for reflection or IPC calls against Activity Manager shell interfaces that are not typical for user applications.
- Correlate mobile threat telemetry with the September 2025 Android patch level to identify unpatched devices in the fleet.
Monitoring Recommendations
- Enforce a minimum Android security patch level of 2025-09-01 through mobile device management (MDM) compliance policies.
- Monitor enterprise mobility platforms for applications requesting shell or debugging-adjacent capabilities.
- Track vendor OEM rollouts of the September 2025 patch across device models and carrier variants.
How to Mitigate CVE-2025-32324
Immediate Actions Required
- Apply the September 2025 Android security patch (patch level 2025-09-01 or later) to all affected Android 15 and Android 16 devices.
- Prioritize patching for devices in high-risk roles, including executive, developer, and privileged administrative users.
- Restrict installation of untrusted third-party applications through MDM policy and Google Play Protect enforcement.
Patch Information
Google published the fix as part of the Android Security Bulletin September 2025. The source-level change is available in AOSP commit 0fb2788dac393086b7e53fbe05414368ae395d9b in the platform/frameworks/base project. Device manufacturers integrate the fix into their per-OEM security patch releases; verify the patch level under Settings → About phone → Android security update.
Workarounds
- No official workaround exists; upgrading to the patched security level is the only supported remediation.
- Limit sideloading and require enterprise app vetting to reduce the population of local applications that could invoke the vulnerable path.
- Enable Google Play Protect and enforce device attestation checks before granting access to sensitive enterprise resources.
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
