CVE-2025-26440
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-08
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 14.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a permissions bypass in multiple functions of CameraService.cpp on the Android platform. It allows an app to use the camera from the background without proper permission checks, leading to a local escalation of privilege. The issue arises because the system does not immediately revoke camera access when an app loses its foreground status, enabling unauthorized camera use without user interaction. [2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing malicious or untrusted applications to access the device camera while running in the background without your knowledge or consent. This unauthorized camera access could lead to privacy violations, such as capturing images or video without user awareness, potentially exposing sensitive information. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively affect compliance with privacy and data protection regulations such as GDPR and HIPAA because it enables unauthorized background camera access without user consent. Such unauthorized data collection or surveillance could violate requirements for user privacy, data minimization, and explicit consent under these regulations. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure your Android system is updated with the patch that modifies CameraService to monitor AppOps foreground changes. This update blocks camera access for apps that lose foreground status, preventing unauthorized background camera usage. Applying the official security update containing this fix is the immediate recommended step. [2]