CVE-2025-26442
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-29
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 14.0 | |
| android | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by a logic error in the onCreate method of NotificationAccessConfirmationActivity.java, where the verification of proper intent filters in the Notification Listener Service (NLS) is done incorrectly. Specifically, the code checks the package name instead of the NLS component name, which can lead to improper granting of notification access permissions. As a result, local information disclosure can occur without needing additional execution privileges or user interaction. [1]
How can this vulnerability impact me? :
The vulnerability can lead to local information disclosure on the affected device. Because the incorrect verification allows improper granting of notification access, an attacker or malicious app could potentially access notifications or related information without proper authorization. This happens without requiring any additional privileges or user interaction, increasing the risk of sensitive data exposure. [1]
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that modifies NotificationAccessConfirmationActivity.java to correctly validate the Notification Listener Service component name instead of the package name. This fix prevents improper granting of notification access permissions and mitigates the vulnerability. Ensure your Android platform's Settings app is updated with the commit identified by hash 63f8849244d1817be2729f522a75424c219e9ecb. [1]