CVE-2025-26419
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-05
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 14.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic error in the initPhoneSwitch function of SystemSettingsFragment.java that allows a possible Factory Reset Protection (FRP) bypass. It means that an attacker could exploit this flaw to escalate their privileges locally on the device without needing any additional execution privileges. However, some user interaction is required to exploit this vulnerability.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to locally escalate their privileges on the affected device, potentially bypassing Factory Reset Protection (FRP). This could lead to unauthorized access or control over the device, compromising its security and the data stored on it.