CVE-2025-26462
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-08
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 14.0 | |
| android | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic error in the Android AccessibilityServiceConnection component that allows an Accessibility Service to remain bound even when its onBind() method returns null. Because of this, the system_server process could keep the service bound and allow it to launch activities from the background without user interaction. This leads to a possible background activity launch, which is a security risk and can be exploited locally to escalate privileges without needing additional execution privileges. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a local attacker or malicious app to launch activities from the background without user interaction, potentially escalating privileges on the device. This could lead to unauthorized actions being performed on your device, compromising security and privacy. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by verifying if the AccessibilityServiceConnection component in the Android framework is patched to unbind Accessibility Services when onBind() returns null. Specifically, checking if the system_server process is improperly keeping accessibility services bound that return null in onBind() could indicate vulnerability. The issue was reproduced and tested using the android.security.cts.Bug_386950836 test case, which can be used to detect the vulnerability on a device. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to apply the patch that modifies AccessibilityServiceConnection to unbind services returning null in onBind(), preventing background activity launches. This fix is included in the Android codebase as of March 7, 2025. Ensuring your Android system is updated to include this patch will mitigate the vulnerability. [1]