CVE-2025-36909 Overview
CVE-2025-36909 is an information disclosure vulnerability affecting Google Android. Google published the advisory as part of the Android Security Bulletin dated September 1, 2025. The weakness is categorized under [CWE-284] Improper Access Control, allowing an unauthenticated network-adjacent actor to read data that should remain protected.
The issue does not require user interaction or elevated privileges to trigger. Successful exploitation exposes limited confidential data without impacting integrity or availability.
Critical Impact
An unauthenticated attacker can obtain sensitive information from an affected Android device over the network without user interaction.
Affected Products
- Google Android (see Android Security Bulletin September 2025 for versions)
- Google Pixel devices covered by the September 2025 Pixel bulletin
- OEM Android builds that inherit the affected component
Discovery Timeline
- 2025-09-04 - CVE-2025-36909 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36909
Vulnerability Analysis
CVE-2025-36909 is an information disclosure issue rooted in improper access control [CWE-284] within Google Android. The affected component fails to enforce authorization checks before returning data, permitting a remote caller to retrieve information that should be restricted to privileged contexts.
The advisory describes the outcome as information disclosure with no integrity or availability impact. The confidentiality impact is limited in scope, meaning the disclosed data is bounded rather than granting full read access to arbitrary system resources.
Google has not publicly released a proof of concept, and no exploit has been observed in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper access control in an Android component that exposes data over a network-reachable interface. The component does not adequately validate the caller's authorization before returning protected information. Google's advisory does not disclose the specific subsystem publicly.
Attack Vector
The attack vector is network-based with low complexity. An attacker sends a crafted request to the vulnerable interface on a reachable Android device. No credentials or user interaction are needed. The response returns information the attacker should not receive. See the Android Security Bulletin September 2025 for component-level details.
Detection Methods for CVE-2025-36909
Indicators of Compromise
- Unexpected inbound network requests to Android device services from untrusted sources on the local network
- Anomalous outbound responses from Android endpoints containing metadata or configuration data
- Devices running Android security patch levels earlier than the September 2025 bulletin
Detection Strategies
- Inventory managed Android devices and correlate the reported security patch level against the September 2025 bulletin baseline
- Monitor mobile device management (MDM) telemetry for devices that have not received the September 2025 patch
- Inspect network traffic on segments containing mobile devices for probing against Android service ports
Monitoring Recommendations
- Alert on Android devices reporting patch levels older than 2025-09-01 via MDM reporting
- Log and review requests to Android-exposed services from unmanaged endpoints on corporate Wi-Fi
- Track vendor advisories for OEM-specific patch rollouts derived from the AOSP fix
How to Mitigate CVE-2025-36909
Immediate Actions Required
- Apply the September 2025 Android security patch level or later on all managed devices
- Enforce MDM compliance policies that block devices below the September 2025 patch baseline from accessing sensitive resources
- Restrict untrusted network access to mobile devices by segmenting corporate Wi-Fi and disabling peer-to-peer discovery where possible
Patch Information
Google addressed CVE-2025-36909 in the September 2025 Android security update. Devices must be updated to a security patch level of 2025-09-01 or later. Refer to the Android Security Bulletin September 2025 for AOSP fix references and OEM guidance. Pixel devices receive the fix through the corresponding Pixel update channel.
Workarounds
- Keep affected devices off untrusted networks until the September 2025 patch is applied
- Use VPN enforcement policies to limit exposure of device services to hostile network segments
- Disable unnecessary network services and sharing features on managed Android devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
