CVE-2025-22422
BaseFortify
Publication date: 2025-09-02
Last updated on: 2025-09-04
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 15.0 | |
| android | 14.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a logic error in the code that can mislead a user into approving an authentication prompt for one application, while the authentication result is actually used by another application. This flaw can cause a local escalation of privilege without requiring any additional execution privileges or user interaction.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to escalate their privileges locally on the affected system without needing extra execution privileges or user interaction. This means an attacker could gain higher access rights than intended, potentially compromising system security.