CVE-2025-32347 Overview
CVE-2025-32347 is a local privilege escalation vulnerability in the Android Settings application. The flaw resides in the onStart method of BiometricEnrollIntroduction.java, where an unsafe PendingIntent allows a local attacker to determine the device's location. Exploitation requires user interaction but no additional execution privileges. Google addressed the issue in the September 2025 Android Security Bulletin. The vulnerability is classified under CWE-926: Improper Export of Android Application Components.
Critical Impact
A local attacker can leverage an unsafe PendingIntent in the biometric enrollment flow to disclose device location data and escalate privileges without requiring additional permissions.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
- Google Android 16
Discovery Timeline
- 2025-09-04 - CVE-2025-32347 published to the National Vulnerability Database (NVD)
- 2025-09-01 - Google publishes the Android Security Bulletin September 2025 addressing the issue
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32347
Vulnerability Analysis
The vulnerability exists in the Android Settings application, specifically inside the BiometricEnrollIntroduction activity used during biometric (fingerprint or face) enrollment. When the activity starts, its onStart method constructs a PendingIntent without properly restricting its target component or mutability. A local malicious application can intercept or hijack this intent to obtain sensitive location information belonging to the Settings process, which holds elevated privileges.
Because the Settings application runs with system-level access, any leaked context from its PendingIntent provides an attacker with information otherwise gated behind runtime permissions. The result is a local elevation of privilege that bypasses the standard Android permission model for location data.
Root Cause
The root cause is improper handling of a PendingIntent inside BiometricEnrollIntroduction.java. The intent lacked adequate component restrictions and immutability flags such as FLAG_IMMUTABLE, allowing a receiving component to modify or redirect it. This maps to [CWE-926], improper export of Android application components.
Attack Vector
Exploitation is local and requires user interaction. A malicious application installed on the device must induce the user to navigate into the biometric enrollment flow. Once triggered, the attacker's app receives or intercepts the exported PendingIntent and extracts location data associated with the Settings context. No additional privileges or elevated Android permissions are needed on the attacker's side.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are available in the Android Settings code change that fixes the issue.
Detection Methods for CVE-2025-32347
Indicators of Compromise
- Installed third-party applications that register broadcast receivers or activities targeting com.android.settings biometric enrollment intents.
- Applications requesting to be launched immediately after biometric enrollment flows without a clear functional reason.
- Anomalous access to location data by processes that lack ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION grants.
Detection Strategies
- Inspect installed APKs for intent filters that match Settings biometric enrollment components or that handle unexpected PendingIntent callbacks.
- Review Android security patch level on managed devices and flag any device below the September 2025 patch level.
- Correlate mobile device management (MDM) telemetry with app installations that occurred shortly before location data queries by non-privileged apps.
Monitoring Recommendations
- Enforce minimum Android security patch level policies through MDM or enterprise mobility management platforms.
- Monitor app installation events on managed Android devices for sideloaded or untrusted APKs targeting Settings intents.
- Track devices still running Android 13, 14, 15, or 16 without the September 2025 patch and prioritize them for remediation.
How to Mitigate CVE-2025-32347
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01 or later) on all affected Android 13, 14, 15, and 16 devices.
- Restrict installation of applications from untrusted sources through MDM policy on managed fleets.
- Audit devices for sideloaded applications that interact with Settings biometric enrollment activities and remove any suspicious apps.
Patch Information
Google addressed CVE-2025-32347 in the Android Security Bulletin September 2025. The corresponding source fix is available in the Android Settings repository, which updates the BiometricEnrollIntroduction activity to construct the PendingIntent with proper component targeting and immutability flags. OEMs distribute the patch through their standard update channels; end users should install the September 2025 or later security update.
Workarounds
- Avoid installing applications from unknown or untrusted sources until the September 2025 patch is applied.
- Limit use of the biometric enrollment flow on unpatched devices, particularly on shared or high-risk endpoints.
- Use enterprise mobility management to enforce Play Protect and block installation of APKs outside approved application catalogs.
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
