What is the CVSS score of CVE-2025-36911?

CVE-2025-36911 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2025-36911?

CVE-2025-36911 presents moderate security risk rated CVSS 7.1. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2025-36911?

Yes, a public proof-of-concept exploit is available for CVE-2025-36911. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-36911?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Android CVE-2025-36911

HIGH

2026-01-15 dsap-vuln-management@google.com

Information Disclosure Google Android

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 28, 2026 - 05:16 vuln.today

Public exploit code

CVE Published

Jan 15, 2026 - 18:16 nvd

HIGH 7.1

DescriptionNVD

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Android versions up to - contains a vulnerability that allows attackers to remote (proximal/adjacent) information disclosure of user's conversations and lo (CVSS 7.1).

Technical ContextAI

affects Android. In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.