CVE-2025-0086: Medium severity Google Android vulnerability
In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0086?
CVE-2025-0086 is considered a medium severity vulnerability due to its potential for local information disclosure.
How do I fix CVE-2025-0086?
To fix CVE-2025-0086, ensure your Android device is updated to the latest available version that addresses this vulnerability.
What types of devices are affected by CVE-2025-0086?
CVE-2025-0086 affects Google Android devices running versions 12.0 through 15.0.
Can CVE-2025-0086 be exploited remotely?
No, CVE-2025-0086 cannot be exploited remotely as it requires local access to the vulnerable device.
What kind of information can be disclosed due to CVE-2025-0086?
CVE-2025-0086 may allow an attacker to overwrite auth tokens, leading to the potential disclosure of sensitive account information.