CVE-2025-22421: Medium severity Google Android vulnerability
Published Apr 7, 2025
·Updated
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
4 affected components
Google Android
Google Android=13.0
Google Android=14.0
Google Android=15.0
Event History
Apr 7, 2025
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
Affected Software
Sep 2, 2025
CVE Published
via MITRE·10:11 PM
Data Sourced
via MITRE·10:11 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs local access and low privileges. No user interaction is required.
2
Does this issue allow modification of device data or denial of service?
The CVSS vector indicates high confidentiality impact, with no integrity or availability impact. The reported effect is disclosure of notification content.