CVE-2025-26435
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-04

Last updated on: 2025-09-29

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-04
Last Modified
2025-09-29
Generated
2026-06-16
AI Q&A
2025-09-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-26435
EUVD
EUVD-2025-27039
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
google android 15.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Android Settings app within the ContentProtectionTogglePreferenceController component. Due to a logic error, a secondary user (such as a guest user) can disable the primary user's deceptive app scanning setting without needing any additional execution privileges or user interaction. This means unauthorized users can change security-related settings that should be restricted to the primary user. [1]

Impact Analysis

The vulnerability can lead to a local escalation of privilege where a secondary user can disable the primary user's deceptive app scanning setting. This could reduce the effectiveness of security protections on the device, potentially allowing malicious apps to go undetected or unscanned, thereby increasing the risk of security breaches or unauthorized app behavior. [1]

Detection Guidance

This vulnerability relates to a logic error in the Android Settings app allowing a secondary user to disable the primary user's ContentProtection setting. Detection involves verifying if guest or secondary users can toggle the ContentProtection setting. There are no specific network detection commands provided. However, you can check the behavior on the device by attempting to toggle the ContentProtection setting as a guest user. Automated tests such as the ContentProtectionTogglePreferenceControllerTest in the Settings RoboTests verify this behavior. [1]

Mitigation Strategies

Apply the patch that disables the ContentProtection setting toggle for guest users, as implemented in the fix committed on February 10, 2025. This prevents guest users from changing the ContentProtection setting and mitigates the privilege escalation risk. Ensure your Android Settings app is updated to include this fix. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-26435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart