EUVD-2025-210011
GHSA-cr9g-295j-fq2w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-privileged app on device
-
DeliveryInvoke unchecked background activity launch path
-
ExploitBypass missing permission check
-
ExecutionExecute code in privileged Android component
-
ImpactEscalate to high confidentiality/integrity/availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have code execution on the device as a local low-privileged app (PR:L), i.e., a malicious or trojanized application installed by the user or another vector - fully remote, network-only exploitation is not possible. No user interaction is required once the malicious app runs (UI:N), and exploitation targets default Android 14/15/16/16-qpr2 platform behavior rather than a non-default configuration. Exploitation is limited by Android's app sandboxing, Play Protect scanning, and the prerequisite that the victim install the attacker's app; managed devices with sideloading disabled and Play Protect enforced significantly reduce attack surface. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H signals a locally exploitable issue requiring an already-installed low-privileged app, no user interaction, and yielding high triad impact - consistent with a meaningful local EoP on mobile devices where the attacker already has a foothold via a malicious app. However, EPSS is 0.01% (0th percentile) and the vulnerability is not on CISA KEV, with no public exploit identified at time of analysis, so real-world weaponization risk is currently low. The Privilege Escalation tag and Android-platform breadth (4 major versions) elevate the strategic patching priority for fleet/MDM operators even though opportunistic mass exploitation is unlikely; the realistic threat model is a malicious or compromised app on a user's device rather than remote attack. No conflicting signals were observed between CVSS and the description - both agree on local vector and no UI. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from a sideload source or a compromised Play listing; the app, running with normal user-level privileges, invokes one of the unchecked code paths to launch a background activity in a more privileged component, executing code in that context without prompting the user. The attacker then leverages the elevated context to access protected data, persist, or further compromise the device. No public POC is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged app to launch background activities without the required permission check, enabling elevation to higher-privileged execution contexts without user interaction. The flaw, tracked as EUVD-2025-210011 and addressed in the June 2026 Android Security Bulletin, carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) with high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis and EPSS is 0.01%, indicating very low predicted exploitation probability in the near term.
RemediationAI
Apply the Android June 2026 security patch level (2026-06-01 or later) as documented at https://source.android.com/docs/security/bulletin/2026/2026-06-01 - this is the vendor-released patch path for Android 14, 15, 16, and 16-qpr2. For managed fleets, enforce SPL >= 2026-06-01 via MDM compliance policies (Android Enterprise, Intune, Workspace ONE) and block enrollment of devices below this level. Until OEM patches arrive, compensating controls are limited because the flaw is in platform code; reduce risk by restricting sideloading via Play Protect enforcement and Google Play-only install policies, auditing installed apps with the BIND_ACCESSIBILITY_SERVICE or activity-launching capabilities, and on managed devices disabling 'Install unknown apps' - note these reduce but do not eliminate exposure from a malicious app already permitted to run.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in Android's activity lifecycle controls, specifically in the background activity launch (BAL) restrictions that Android has progressively tightened since Android 10 to prevent malicious apps from displaying UI or executing code in privileged contexts while not in the foreground. According to the description, multiple code paths fail to perform a permission check before allowing a background activity launch, which is functionally a missing authorization (CWE-862 class, though CWE is listed as N/A in the input). The affected CPE is cpe:2.3:a:google:android (framework/platform component), spanning Android 14 through 16-qpr2, suggesting the regression or oversight exists across several major platform releases and was likely identified during internal review or external researcher disclosure feeding into the AOSP security bulletin process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android versions 14-16 contain a local privilege escalation vulnerability (CVE-2025-32348, CVSS 7.8) allowing low-privileged apps to elevate permissions without user interaction, potentially compromising confidentiality and integrity on affected devices. Organizations managing Android endpoints face risk if users install untrusted applications; however, predicted exploitation likelihood is currently very low (0.0% EPSS).
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce app installation restrictions to official app stores only, disabling sideloading; (2) Restrict background activity and dangerous runtime permissions through Mobile Device Management (MDM) policies; (3) Implement runtime monitoring and alerting for privilege escalation attempts; (4) Audit installed applications for legitimacy and remove untrusted apps; (5) Apply Google Android security patch immediately upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB