CVE-2025-26417: Medium severity Google Android vulnerability
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26417?
CVE-2025-26417 has been classified as a medium severity vulnerability due to its potential for local information disclosure.
How do I fix CVE-2025-26417?
To fix CVE-2025-26417, update the affected Android software to the latest version that includes the security patch for this vulnerability.
What does CVE-2025-26417 exploit?
CVE-2025-26417 exploits a bypass of user consent when accessing files in shared storage, potentially allowing information disclosure.
What systems are affected by CVE-2025-26417?
CVE-2025-26417 affects devices running specific versions of Google Android that utilize the DownloadProvider component.
Is user interaction required for exploiting CVE-2025-26417?
No, exploiting CVE-2025-26417 does not require user interaction, making it a more concerning vulnerability.