CVE-2025-32329: Google Android Privilege Escalation Flaw

CVE-2025-32329 Overview

CVE-2025-32329 is a local privilege escalation vulnerability in the Android operating system. The flaw resides in multiple functions of Session.java within the Android framework. A logic error in the code allows a local user to view images belonging to a different user on the same device. Exploitation requires no additional execution privileges and no user interaction. Google addressed the issue in the December 2025 Android Security Bulletin.

Critical Impact
A local attacker with low privileges can access images owned by other device users, breaking Android's multi-user isolation model and exposing sensitive personal data.

Affected Products

Google Android 13.0
Google Android 14.0
Google Android 15.0

Discovery Timeline

2025-12-08 - CVE-2025-32329 published to the National Vulnerability Database (NVD)
2025-12-01 - Google publishes the Android Security Bulletin 2025-12-01 with fix commit e030442861f4dd0e03d67b65f0940b488007f0d7
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32329

Vulnerability Analysis

The vulnerability affects Session.java in the Android platform framework. Session handling code contains a logic error across multiple functions that fails to correctly enforce the boundary between distinct device users. Android supports multiple user profiles on a single device, each with segregated storage and content. When session-scoped operations resolve image content, the affected code paths do not consistently validate that the requesting user owns the returned assets.

The result is a horizontal privilege escalation. A process running as one user can retrieve image data belonging to a separate user profile on the same device. Because the affected class is part of the framework, the flaw is reachable from standard application contexts without SELinux transitions or elevated capabilities.

Root Cause

The root cause is an authorization logic error rather than memory corruption. The affected functions in Session.java rely on session state that does not sufficiently constrain returned resources to the calling user's identity. NVD categorizes the weakness under NVD-CWE-noinfo, but the behavior aligns with Broken Access Control and Improper Authorization.

Attack Vector

The attack vector is local. An attacker requires code execution on the device with low privileges, typically achievable through an installed application or a compromised process. No user interaction is required. Exploitation targets the framework session APIs that expose image content, allowing the attacker to enumerate or retrieve images associated with other user profiles on the device.

The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept exploit is available. The EPSS score is 0.086%, indicating a low predicted probability of exploitation in the near term.

For implementation-level details, refer to the Android Source Code Change that resolves the issue.

Detection Methods for CVE-2025-32329

Indicators of Compromise

Applications making anomalous calls to framework session APIs that return image content across user boundaries.
Unexpected access patterns to /data/media/<user_id>/ paths from processes running under a different user ID.
Installed applications requesting broad media or storage permissions without a corresponding legitimate feature.

Detection Strategies

Audit Android device build fingerprints and security patch levels to identify devices missing the December 2025 patch.
Review mobile threat defense telemetry for applications invoking media session APIs outside their expected user context.
Correlate application install events with subsequent access to shared framework services handling images.

Monitoring Recommendations

Enroll devices in a mobile device management (MDM) platform that reports the Android security patch level and blocks non-compliant devices.
Monitor for sideloaded APKs and applications from untrusted sources on managed Android devices.
Log and review permission grants for media, photos, and storage across enterprise device fleets.

How to Mitigate CVE-2025-32329

Immediate Actions Required

Apply the December 2025 Android security patch (2025-12-01 security patch level or later) to all affected devices.
Prioritize patching for devices running Android 13, 14, and 15 that hold sensitive corporate or personal data across multiple user profiles.
Restrict installation of applications from untrusted sources on managed devices until patches are deployed.

Patch Information

Google released a fix in the Android Security Bulletin 2025-12-01. The specific code change is available in the Android Open Source Project commit. Original equipment manufacturers (OEMs) integrate these fixes into device-specific over-the-air updates on varying schedules; consult vendor advisories for release timing on Samsung, Pixel, and other devices.

Workarounds

Avoid using the multi-user feature on unpatched devices where cross-user image confidentiality is required.
Limit the number of user profiles configured on shared Android devices until patches are applied.
Enforce enterprise policies that require the latest available Android security patch level before granting access to corporate resources.

bash

# Verify the Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-12-01 or later