CVE-2025-26431
published 2025-09-04CVE-2025-26431: In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.09%
0.4th percentile
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android 14 Accessibility Service AccessibilityFragment.java setupAccessibilityServices protection mechanism (EUVD-2025-26891)
vuldb·2026-10-02·CVSS 7.8
CVE-2025-26431 [HIGH] Google Android 14 Accessibility Service AccessibilityFragment.java setupAccessibilityServices protection mechanism (EUVD-2025-26891)
A vulnerability classified as problematic was found in Google Android 14. This impacts the function setupAccessibilityServices of the file AccessibilityFragment.java of the component Accessibility Service. Executing a manipulation can lead to protection mechanism failure.
This vulnerability is tracked as CVE-2025-26431. The attack is restricted to local execution. No exploit exists.
Applying a patch is advised to resolve this issue.
GHSA
GHSA-wgx9-7jp7-736m: In setupAccessibilityServices of AccessibilityFragment
ghsa_unreviewed·2025-09-04
CVE-2025-26431 [HIGH] CWE-693 GHSA-wgx9-7jp7-736m: In setupAccessibilityServices of AccessibilityFragment
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-04
Published