CVE-2025-32326 Overview
CVE-2025-32326 is a local privilege escalation vulnerability in the Android Settings application. The flaw resides in multiple functions of AppRestrictionsFragment.java and stems from a confused deputy condition that allows attackers to bypass intent security checks. Google addressed the issue in the September 2025 Android Security Bulletin.
An attacker with local access and low privileges can leverage this weakness to elevate privileges without requiring additional execution rights. Exploitation requires user interaction, which limits mass exploitation scenarios but does not eliminate practical attack paths through social engineering.
Critical Impact
Local attackers can escalate privileges on affected Android devices by tricking a privileged Settings component into acting on attacker-controlled intents, gaining high-impact access to confidentiality, integrity, and availability.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0 and 16.0
Discovery Timeline
- 2025-09-04 - CVE-2025-32326 published to NVD
- 2025-09-01 - Google publishes Android Security Bulletin addressing the flaw
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32326
Vulnerability Analysis
The vulnerability is classified under [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)]. The affected code path lives in AppRestrictionsFragment.java, a component of the Android Settings app that manages per-app restrictions for restricted user profiles. This fragment operates with elevated privileges to configure restrictions on behalf of the device owner.
A confused deputy condition arises when a privileged component performs actions on behalf of a less-privileged caller without adequately validating the caller's authority or the target of those actions. In this case, multiple functions within AppRestrictionsFragment.java process intents without sufficient security validation, allowing an unprivileged local app to influence privileged operations.
Root Cause
The root cause is missing or inadequate intent validation across multiple entry points in AppRestrictionsFragment.java. Because the fragment does not verify the source or target of intents it processes, a local attacker can craft an intent that the privileged Settings context redirects or acts upon. The upstream fix commit e8a17485771e54124abc08e8fb6c987bf83726a2 in the Android Settings repository adjusts these code paths to enforce proper security checks.
Attack Vector
Exploitation requires a malicious application installed on the device and user interaction with a crafted UI element or notification. The attacking app sends a specially constructed intent that the AppRestrictionsFragment then processes with Settings-level privileges. The result is a local privilege escalation, giving the attacker capabilities beyond those granted to a normal third-party app.
No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Android Security Bulletin September 2025 and the Android Settings code change for technical details.
Detection Methods for CVE-2025-32326
Indicators of Compromise
- Installation of unknown or sideloaded applications shortly before unexpected changes to user restrictions or profile configurations.
- Anomalous intents targeting com.android.settings components, particularly those associated with AppRestrictionsFragment.
- Newly created or modified restricted user profiles without corresponding device owner action.
Detection Strategies
- Monitor mobile device management (MDM) telemetry for changes to app restriction policies that do not originate from administrative workflows.
- Inspect application logs on managed Android fleets for intents dispatched to Settings components from non-system packages.
- Use behavioral analytics to flag third-party apps that trigger Settings-based configuration changes.
Monitoring Recommendations
- Track Android security patch levels across the fleet and alert on devices running builds prior to the September 2025 patch level.
- Correlate app install events with subsequent privilege-level state changes on the same device.
- Review MDM audit logs for anomalous restricted-profile creation or modification events.
How to Mitigate CVE-2025-32326
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01 or later) to all affected devices running Android 13, 14, 15, and 16.
- Restrict sideloading and enforce Google Play Protect on managed devices through MDM policy.
- Audit installed applications on managed Android endpoints and remove unknown or unnecessary packages.
Patch Information
Google fixed the vulnerability in the September 2025 Android Security Bulletin. The upstream code change is available in the Android Settings repository at commit e8a17485771e54124abc08e8fb6c987bf83726a2. Device manufacturers ship the fix as part of the 2025-09-01 security patch level. Users should install the latest OTA update from their device vendor.
Workarounds
- Avoid installing untrusted third-party applications, particularly on devices used with restricted user profiles.
- Disable or avoid using the restricted profiles feature on unpatched devices where feasible.
- Enforce MDM policies that block installation from unknown sources until patches are deployed.
# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
