CVE-2025-26436 — Incorrect Authorization in Frameworks Base

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 99.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedSep 4
Latest updateSep 5

Description

In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Androidplatform/frameworks_base15-next:0 — 15-next:2025-05-01+3
▶CVEListV5google/android13, 14, 15+2
▶NVDgoogle/android13.0, 14.0, 15.0+2

Patches

Patch: android.googlesource.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-j64g-h5x4-3jg2: In clearAllowBgActivityStarts of PendingIntentRecord↗2025-09-05
▶
CVEList
CVE-2025-26436: In clearAllowBgActivityStarts of PendingIntentRecord↗2025-09-04
▶
OSV
CVE-2025-26436: In clearAllowBgActivityStarts of PendingIntentRecord↗2025-05-01
▶

📋Vendor Advisories

1
Android
CVE-2025-26436: Android Security Bulletin 2025-05-01 CVE: CVE-2025-26436 Severity: HIGH Type: EoP Affected AOSP versions: 13, 14, 15 References: A-322159724 [2]↗2025-05-01
▶
CVE-2025-26436 — Incorrect Authorization | cvebase