CVE-2025-26418: High severity Google Android (CarDevicePolicyService) vulnerability
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a missing permission check in setUserDisclaimerAcknowledged so that only callers holding the appropriate permission can mark the user disclaimer acknowledged; otherwise require the normal user dialog flow and deny unauthorized attempts to bypass it.
CarDevicePolicyService.java (setUserDisclaimerAcknowledged) permission_check = enforce required permission before allowing disclaimer to be acknowledged
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26418?
CVE-2025-26418 has a high severity rating of 7.8 based on the CVSS 3.1 scoring system.
How do I fix CVE-2025-26418?
To fix CVE-2025-26418, ensure that all managed devices are updated to the latest security patches provided by Google.
What is the risk associated with CVE-2025-26418?
CVE-2025-26418 has a risk score of 69, indicating a significant potential impact on user data and device security.
What types of devices are affected by CVE-2025-26418?
CVE-2025-26418 affects Google Android devices utilizing the CarDevicePolicyService.
What is the main issue with CVE-2025-26418?
The main issue with CVE-2025-26418 is a missing permission check that allows local escalation of privilege when adding an account to a managed device.