EUVD-2025-210008
GHSA-cgw7-gqg5-536h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall low-privilege app on device
-
DeliveryTrigger improper input validation across user boundary
-
ExploitSolicit brief user interaction
-
ExecutionRead images from another user profile
-
ImpactUse disclosed data to escalate local privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Attacker must already have local code execution on the target Android 14, 15, 16, or 16-qpr2 device, typically via a low-privilege installed application (PR:L), and the device must contain image content belonging to another user or profile for cross-user disclosure to be meaningful. Exploitation requires user interaction per the description (a tap, swipe, or confirmation by the victim), which contradicts the published UI:N in the CVSS vector and should be treated as a limiting factor. The bug exists in multiple platform locations, so no single non-default configuration is required, but practical impact is bounded to multi-user or work-profile deployments where there are other users' images to expose. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable issue requiring low privileges with low complexity and high impact across confidentiality, integrity, and availability - yet the description explicitly states 'User interaction is needed for exploitation,' which conflicts with the UI:N component of the published vector; this discrepancy should be verified against the Android Security Bulletin. EPSS sits at 0.09% (26th percentile), and the CVE is not on CISA KEV, indicating no public exploit identified at time of analysis. Despite the High CVSS score, the local attack vector, requirement for an installed/co-resident attacker context, and absence of exploitation telemetry make this a moderate, not urgent, priority - patch alongside the June 2026 Android bulletin rather than as an emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign application on a multi-user Android device; the malicious app, running with low privileges in one user profile, triggers the input-validation flaw and induces the victim to perform a brief UI action (e.g., tap a notification or open a shared view) that causes images belonging to another user profile to be exposed to the attacker-controlled app. The attacker then exfiltrates the disclosed images, leveraging them for further privilege escalation within the local device. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android 14, 15, 16, and 16-qpr2 allows a local attacker with low privileges to reveal images across user boundaries through improper input validation in multiple code locations. The flaw requires user interaction but no additional execution privileges, and carries a CVSS 7.8 (High) rating. EPSS exploitation probability is low at 0.09% (26th percentile), and there is no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply the June 2026 Android security patch level as documented in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01, which addresses CVE-2025-22424 across Android 14, 15, 16, and 16-qpr2 - OEM-specific patched build numbers should be confirmed with the device manufacturer. Until the patch is installed, limit exposure by restricting installation of untrusted applications (the local attacker context this bug requires), avoiding granting storage or media permissions to non-essential apps, and disabling secondary user profiles on shared devices where cross-user image leakage would matter; the trade-off is reduced multi-user functionality and user friction around app installation. Verify NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-22424 and VulDB at https://vuldb.com/vuln/367837 for any updated mitigation guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Android platform (cpe:2.3:a:google:android) across multiple components where input validation is insufficient, enabling cross-user image disclosure. Android enforces per-user data isolation through its multi-user framework and storage sandboxing, so a bypass that exposes images from another user profile constitutes a violation of the platform's fundamental isolation model. Although the CWE is unspecified, the description maps to improper input validation (CWE-20) leading to information disclosure across security boundaries, ultimately resulting in privilege escalation when an attacker leverages the disclosed data within the local user context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Executive ViewAI
Android 14, 15, 16, and 16-qpr2 create immediate organizational privacy risk through CVE-2025-22424, which allows local attackers to access images across user accounts without authorization. No public exploit identified at time of analysis, but the vulnerability's accessibility and broad device deployment pose significant compliance exposure. With no vendor patch available, organizations must deploy immediate interim controls to restrict image access across user boundaries.
No vendor-released patch identified at time of analysis. Interim mitigations: disable multi-user profiles and guest accounts; restrict application file access through MDM policies; implement Mobile Threat Defense (MTD) for behavioral monitoring; enforce physical device access controls; monitor system logs for privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB