CVE-2025-26436
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-29
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 14.0 | |
| android | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-26436 is a security vulnerability in the Android platform where the method clearAllowBgActivityStarts in PendingIntentRecord.java does not fully clear all background activity launch (BAL) allowlist entries. Specifically, it removes associated tokens but fails to clear duration-based entries, which could allow an application to launch an activity from the background without user interaction. This leads to a possible local escalation of privilege without needing additional execution privileges. [1]
How can this vulnerability impact me? :
This vulnerability could allow a malicious application to start activities from the background without user interaction, bypassing background activity launch restrictions. This can lead to local privilege escalation on the device, potentially enabling unauthorized actions or access to sensitive functions without additional permissions. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Android system is updated with the patch that fixes CVE-2025-26436. The fix involves updating the Android framework base code, specifically the PendingIntentRecord.java file, to properly clear all allowlist entries related to Background Activity Launch privileges. Applying the official security update from Android that includes this patch will prevent unauthorized background activity starts and local privilege escalation. [1]