EUVD-2025-210014
GHSA-f8pv-pc56-3g7m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Lockdown mode bypass in Google Android exposes protected information via a logic error in KeyguardViewMediator.java that allows screen pinning to circumvent lockdown protections. Affected versions span Android 14, 15, 16, and 16-qpr2, with exploitation requiring only local low-privileged access and no user interaction. No public exploit has been identified at time of analysis, and the CVSS score of 3.3 reflects a limited-scope, local-only confidentiality impact.
Technical ContextAI
KeyguardViewMediator.java is a core Android framework component responsible for managing the keyguard (lock screen), including lockdown mode - a user-triggered security state that disables biometric authentication and forces PIN/password entry. The vulnerability stems from a logic error across multiple functions in this class where the interplay between lockdown mode and screen pinning (Android's app-pinning feature that locks the UI to a single foreground application) is incorrectly evaluated. This interaction allows lockdown protections to be silently bypassed. No CWE is formally assigned, but the root cause class maps conceptually to business logic errors (CWE-840) or incorrect condition checking. The affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, confirming this is a platform-level Android issue rather than an OEM or third-party library defect.
RemediationAI
Apply security patches referenced in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01), which addresses the logic error in KeyguardViewMediator.java across Android 14, 15, 16, and 16-qpr2. Exact patched build/SPL version numbers are not confirmed from available intelligence - consult the bulletin directly for the applicable patch level. OEM device vendors (Samsung, Google Pixel, etc.) must distribute patched builds, so users should monitor and apply device-specific OTA updates. As a compensating control where patching is delayed, enterprise administrators can disable screen pinning via Android Enterprise MDM policy using DevicePolicyManager restrictions, which prevents the specific feature interaction that enables exploitation - note this removes legitimate screen pinning functionality for all users on managed devices. Organizations using lockdown mode as a security assurance mechanism should treat affected unpatched devices as having reduced confidentiality guarantees.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today