CVE-2025-26453
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-08
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 15.0 | |
| android | 14.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic error in the Bluetooth OPP (Object Push Profile) implementation, specifically in the isContentUriForOtherUser method of BluetoothOppSendFileInfo.java. It causes a possible cross-user data leak by incorrectly determining the userId, which can lead to local information disclosure without needing additional execution privileges or user interaction. [1]
How can this vulnerability impact me? :
The vulnerability can lead to local information disclosure by leaking data across different users on the same device. This means that one user could potentially access data belonging to another user without proper authorization, compromising user privacy and data security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves verifying if the Bluetooth OPP implementation correctly parses the userId from the authority component as per the fix. This can be tested by running the Google Bluetooth test suite with the command `m com.google.android.bt` and Android unit tests using `atest BluetoothJavaUnitTests:com.android.bluetooth.opp.BluetoothOppSendFileInfoTest`. Additionally, building and running the Fluoride Bluetooth stack on a Linux system and observing its behavior can help detect the presence or absence of the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Bluetooth OPP implementation to include the fix that aligns userId parsing with the Android ContentProvider logic. This involves applying the patch identified by commit hash 495d32429fd801c6cd7fe5e568b9c805f47fb4ed to the BluetoothOppSendFileInfo.java source file. Rebuild and deploy the updated Fluoride Bluetooth stack or Android Bluetooth module. Running the provided test suites ensures the fix is correctly applied and no regressions occur. [1]