CVE-2025-32346 Overview
CVE-2025-32346 is a confused deputy vulnerability in the Android VoicemailSettingsActivity component. The flaw resides in the onActivityResult method of VoicemailSettingsActivity.java and permits a work profile contact number to leak across profile boundaries. Google addressed the issue in the September 2025 Android Security Bulletin. The vulnerability affects Android 16.0 and requires no user interaction to exploit.
Critical Impact
A local application with low privileges can obtain work profile contact numbers, enabling privilege escalation and cross-profile information disclosure without user interaction.
Affected Products
- Google Android 16.0
- Devices running Android with the affected VoicemailSettingsActivity component
- Managed device deployments using work profiles for data separation
Discovery Timeline
- 2025-09-04 - CVE-2025-32346 published to the National Vulnerability Database (NVD)
- 2025-09-01 - Google publishes the Android Security Bulletin September 2025 with the fix
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32346
Vulnerability Analysis
The vulnerability is classified under [CWE-441] as a confused deputy weakness. The VoicemailSettingsActivity component acts on behalf of a caller without correctly verifying whether that caller should access work profile data. When onActivityResult handles a returned intent, the activity discloses a contact number that belongs to the managed work profile to a caller in the personal profile.
Android enforces strict separation between personal and work profiles to protect enterprise data on personal devices. A local application in the personal profile can leverage the privileged VoicemailSettingsActivity to bypass this boundary. The result is a local escalation of privilege because the caller obtains data it is not authorized to view.
Exploitation does not require additional execution privileges and needs no user interaction. This makes the flaw viable for silent data collection by any installed application capable of invoking the activity.
Root Cause
The root cause is missing or insufficient caller identity validation in the onActivityResult handler of VoicemailSettingsActivity.java. The activity trusts intent data returned to it without confirming that the requesting component has authorization to receive work profile contact information.
Attack Vector
A malicious local application in the personal profile launches VoicemailSettingsActivity and receives a result intent containing a work profile contact number. The vulnerability manifests entirely on the local device. See the Android Security Bulletin September 2025 for the vendor-provided technical description.
Detection Methods for CVE-2025-32346
Indicators of Compromise
- Unexpected invocations of VoicemailSettingsActivity by third-party applications on the personal profile
- Applications requesting or logging phone numbers that match work profile contacts
- Unusual cross-profile intent traffic on managed Android devices
Detection Strategies
- Review installed application permissions and behavior on managed devices, focusing on apps that programmatically launch dialer or voicemail settings activities
- Use mobile threat defense telemetry to flag applications that read or exfiltrate contact identifiers shortly after launching system settings activities
- Correlate work profile contact access events with subsequent network egress to identify potential data exfiltration
Monitoring Recommendations
- Enable enterprise mobility management (EMM) reporting on cross-profile intent activity and policy violations
- Monitor Android build fingerprints across the fleet to confirm devices are running the September 2025 patch level or later
- Ingest mobile device logs into a centralized data lake for behavioral analysis and long-term retention
How to Mitigate CVE-2025-32346
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01 or later) to all affected devices
- Prioritize patching on devices enrolled in work profile or Android Enterprise deployments
- Audit installed applications on personal profiles for unnecessary or untrusted software
Patch Information
Google released the fix in the Android Security Bulletin September 2025. Device manufacturers integrate the patch into their monthly security updates. Confirm devices report a security patch level of 2025-09-01 or later after update.
Workarounds
- Restrict installation of third-party applications on personal profiles of managed devices through EMM policy
- Limit sensitive contact data stored in the work profile until devices are patched
- Disable side-loading and enforce Google Play Protect on managed Android endpoints
# Verify Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
