What is the CVSS score of CVE-2025-26418?

CVE-2025-26418 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android Automotive are affected by CVE-2025-26418?

A privilege escalation in Google Android 14 and 15 enables unauthorized account provisioning on enterprise-managed automotive devices, bypassing user consent controls that organizations rely on for…

How to fix or mitigate CVE-2025-26418?

Within 24 hours: Inventory all Google Android 14 and 15 devices in managed automotive deployments and assess exposure scope. Within 7 days: Enforce app installation policies through your enterprise device management platform and configure audit logging for account provisioning events on affected devices. Within 30 days: Apply vendor-released patch immediately upon availability and verify deployment across your entire affected fleet.

Android Automotive CVE-2025-26418

EUVD-2025-210010 HIGH

Missing Authorization (CWE-862)

2026-06-01 google_android

GHSA-972f-8p3j-73wm

Privilege Escalation Authentication Bypass

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 14:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 14:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 14:22 vuln.today

cvss_changed

Severity Changed

Jun 03, 2026 - 14:22 NVD

MEDIUM HIGH

CVSS changed

Jun 03, 2026 - 14:22 NVD

5.9 (MEDIUM) 7.8 (HIGH)

Analysis Generated

Jun 02, 2026 - 14:28 vuln.today

CVSS changed

Jun 02, 2026 - 14:22 NVD

5.9 (MEDIUM)

CVE Published

Jun 01, 2026 - 21:14 nvd

MEDIUM 5.9

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android 14 and 15 allows a low-privileged app to bypass the user disclaimer dialog when adding an account to a managed automotive device, due to a missing permission check in CarDevicePolicyService.setUserDisclaimerAcknowledged. The flaw enables silent account provisioning on managed (enterprise) car devices without the user's awareness or consent, and no public exploit is identified at time of analysis. EPSS is negligible (0.01%) and SSVC marks exploitation as 'none', so the issue is real but not currently weaponized.

Technical ContextAI

The vulnerability lives in CarDevicePolicyService.java, part of the Android Automotive (Car) framework used by Android-based in-vehicle infotainment systems and managed by Device Policy Manager APIs. The setUserDisclaimerAcknowledged method is intended to be callable only after the user has interactively seen and accepted a disclaimer when an enterprise/managed account is provisioned, but the method omits the caller-side permission check that gates this state transition. This is a textbook CWE-862 (Missing Authorization) issue: the trusted internal state ('user has acknowledged the disclaimer') can be set by an unprivileged caller, short-circuiting an explicit security UX control built into Android's managed-device account flow. The affected platform identified by CPE is cpe:2.3:a:google:android (any version field), with EUVD scoping the practical impact to Android 14 and Android 15 automotive builds.

RemediationAI

Apply the patch level from the Android Security Bulletin dated 2026-06-01 (https://source.android.com/docs/security/bulletin/2026/2026-06-01) on all Android 14 and Android 15 Automotive devices; the bulletin lists the exact source-tree fix for CarDevicePolicyService.setUserDisclaimerAcknowledged and the corresponding security patch level OEMs must ship. Vehicle OEMs and fleet operators should coordinate the OTA rollout with their Tier-1 supplier, since Android Automotive patches lag mainline Android and are gated by per-OEM release trains. As a compensating control until the OTA lands, restrict which apps can be sideloaded or pre-installed on managed car devices via Device Owner allow-listing, and avoid enrolling vehicles into managed-account workflows that rely on the disclaimer dialog for user awareness - the trade-off is reduced enterprise account-provisioning convenience. Generic compensating controls such as 'don't install untrusted apps' are weak here because exploitation only requires PR:L (any low-privileged app), so app vetting on the head unit is the highest-leverage interim mitigation.