CVE-2025-36904: Google Android WLAN Privilege Escalation

CVE-2025-36904 Overview

CVE-2025-36904 is a privilege escalation vulnerability in the WLAN component of Android on Google Pixel devices. The flaw, tracked internally as A-396458384, affects Pixel devices running Android builds prior to the 2025-09-05 security patch level. The vulnerability is classified under [CWE-269] Improper Privilege Management. An attacker exploiting this issue can elevate privileges on the targeted device without user interaction. Google addressed the issue in the September 2025 Pixel security bulletin.

Critical Impact
Successful exploitation grants elevated privileges on Pixel devices, enabling attackers to compromise device integrity, confidentiality, and availability through the WLAN subsystem.

Affected Products

Google Pixel devices running Android before patch level 2025-09-05
Android WLAN subsystem on Pixel hardware
Devices missing the September 2025 Pixel security update

Discovery Timeline

2025-09-04 - CVE-2025-36904 published to NVD
2025-09-05 - Last updated in NVD database
2025-09-01 - Google publishes Pixel Security Bulletin addressing the issue

Technical Details for CVE-2025-36904

Vulnerability Analysis

The vulnerability resides in the WLAN (Wireless LAN) component of Android on Google Pixel devices. It is categorized as an improper privilege management issue [CWE-269]. An attacker who triggers the flaw can obtain elevated privileges beyond what the application or process should normally hold. Because the WLAN stack operates with elevated system permissions, a successful exploit can break the Android sandbox and compromise core device functions.

Google's advisory describes the issue only at a high level, identifying it by the internal bug reference A-396458384. The bulletin does not disclose exploit specifics, reflecting Google's standard practice of withholding technical detail until patch adoption is widespread.

Root Cause

The root cause is improper privilege management within the WLAN driver or service path on Pixel devices. Code in the WLAN subsystem fails to correctly enforce privilege boundaries, allowing operations that should require higher authorization to be invoked from a lower-privileged context. This class of flaw typically arises from missing capability checks, unsafe IPC handling, or trust assumptions on attacker-controlled input.

Attack Vector

The CVSS vector lists Network as the attack vector with no privileges and no user interaction required. In practical terms, an attacker within wireless range or able to interact with the WLAN stack remotely can deliver a crafted input that triggers the elevation. Successful exploitation impacts confidentiality, integrity, and availability at high severity.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS exploitation probability remains low at the time of disclosure.

Technical exploitation specifics have not been released by Google. Refer to the Android Security Bulletin September 2025 for vendor guidance.

Detection Methods for CVE-2025-36904

Indicators of Compromise

Pixel devices reporting a security patch level earlier than 2025-09-05
Unexpected system-level processes spawned following WLAN-related events
Anomalous WLAN driver crashes or kernel log entries referencing the WLAN subsystem

Detection Strategies

Inventory Pixel devices and verify the Android security patch level reported in Settings > About phone
Monitor mobile device management (MDM) compliance reports for devices below patch level 2025-09-05
Correlate WLAN driver fault logs with subsequent privilege changes or new system processes

Monitoring Recommendations

Enforce MDM policies that block or quarantine devices missing the September 2025 Pixel update
Collect Android logcat and kernel telemetry from managed devices where supported
Track network traffic from Pixel devices for unexpected outbound connections following WLAN events

How to Mitigate CVE-2025-36904

Immediate Actions Required

Install the September 2025 Pixel security update on all affected Google Pixel devices
Confirm the Android security patch level is 2025-09-05 or later after updating
Restrict affected devices from untrusted Wi-Fi networks until patched

Patch Information

Google released the fix in the Android Security Bulletin September 2025 for Pixel devices. Devices with security patch level 2025-09-05 or later contain the fix. Apply updates through Settings > System > System update or through enterprise MDM-driven update channels.

Workarounds

Disable Wi-Fi on unpatched Pixel devices when operating in untrusted environments
Limit Pixel device access to trusted, monitored wireless networks only
Enroll devices in an MDM solution that enforces minimum Android patch levels before granting corporate resource access

bash

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-05 or later