CVE-2025-32328: Google Android Privilege Escalation Flaw

CVE-2025-32328 Overview

CVE-2025-32328 is a local privilege escalation vulnerability in the Android operating system. The flaw resides in multiple functions of Session.java within the Android framework. A logic error in the code allows a local attacker to view images belonging to a different user of the device. Exploitation requires local access with low privileges but no user interaction. Google addressed the issue in the December 2025 Android Security Bulletin. The vulnerability affects Android versions 13, 14, and 15.

Critical Impact
A local, low-privileged application can view images belonging to other device users, breaking the multi-user isolation boundary and enabling local privilege escalation without user interaction.

Affected Products

Google Android 13.0
Google Android 14.0
Google Android 15.0

Discovery Timeline

2025-12-01 - Google publishes fix in the Android Security Bulletin
2025-12-08 - CVE-2025-32328 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32328

Vulnerability Analysis

The vulnerability is a business logic error inside multiple functions of Session.java, part of the Android frameworks/base component. Android supports multiple user profiles on a single device, and the framework enforces isolation of user-owned resources such as images, documents, and app data. The logic error in Session.java breaks this isolation. A local process running as one user can invoke session paths that return image resources belonging to a different user on the same device. The result is a horizontal privilege escalation across the Android multi-user boundary. NVD classifies the weakness as [CWE-noinfo] because Google has not published the underlying weakness taxonomy for this issue.

Root Cause

The root cause is an incorrect authorization check inside session handling code. The affected functions in Session.java fail to correctly validate that the caller and the target image resource belong to the same user context. Because the check is a logic error rather than a missing check, standard permission gates pass while the ownership comparison is bypassed. The upstream fix is tracked in commit e030442861f4dd0e03d67b65f0940b488007f0d7 in the Android platform/frameworks/base repository.

Attack Vector

An attacker requires code execution on the device with low privileges, which is satisfied by any installed application. The attacker's app calls into the vulnerable Session.java code paths and requests image content associated with another user on the device. Because user interaction is not required, the read can occur silently in the background. The attack is local only and cannot be triggered remotely over the network. See the Android Security Bulletin 2025-12-01 for the vendor description.

Detection Methods for CVE-2025-32328

Indicators of Compromise

Installed applications that request or enumerate media content across user profile boundaries without a matching foreground user action.
Unexpected access patterns to media provider URIs originating from apps that have no legitimate cross-user use case.
Devices running Android 13, 14, or 15 that have not received the 2025-12-01 security patch level.

Detection Strategies

Inventory managed Android fleets and flag devices whose ro.build.version.security_patch is earlier than 2025-12-01.
Review Mobile Threat Defense telemetry for apps invoking media session APIs at high frequency or with anomalous caller identifiers.
Correlate app install events with subsequent media access spikes to identify potentially abusive apps.

Monitoring Recommendations

Enforce enterprise mobility management (EMM) policies that report and gate the Android security patch level on every enrolled device.
Monitor Google Play Protect and vendor threat feeds for apps flagged as abusing multi-user or media session APIs.
Alert on any managed device that remains on a pre-December 2025 patch level beyond your standard remediation window.

How to Mitigate CVE-2025-32328

Immediate Actions Required

Apply the December 2025 Android security patch (patch level 2025-12-01 or later) to all Android 13, 14, and 15 devices.
Prioritize patch deployment on shared or multi-user devices, kiosks, and family-shared tablets where cross-user data exposure risk is highest.
Restrict installation of untrusted or sideloaded applications through EMM policy until devices are patched.

Patch Information

Google released a fix through the Android Security Bulletin 2025-12-01. The corresponding source change is available in the AOSP frameworks/base commit e030442861f4dd0e03d67b65f0940b488007f0d7. Device OEMs distribute the patch via their standard monthly security update channel. Users should install any available system update from Settings once their carrier or OEM releases the December 2025 patch level.

Workarounds

No official workaround exists; the vendor fix is the only complete remediation.
On devices that cannot be patched immediately, avoid provisioning secondary user profiles or guest accounts that store sensitive images.
Limit installed apps to those from trusted publishers and keep Google Play Protect enabled to reduce the risk of a malicious local caller.

bash

# Verify the Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2025-12-01 or later