CVE-2025-26418: High severity Google Android (CarDevicePolicyService) vulnerability
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/services/Carto a version that resolves this vulnerability.Fixed in 17-next:2026-06-01 - Upgrade
Upgrade
android/platform/packages/services/Carto a version that resolves this vulnerability.Fixed in 15:2026-06-01 - Upgrade
Upgrade
android/platform/packages/services/Carto a version that resolves this vulnerability.Fixed in 14:2026-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26418?
CVE-2025-26418 has a high severity rating of 7.8 based on the CVSS 3.1 scoring system.
How do I fix CVE-2025-26418?
To fix CVE-2025-26418, ensure that all managed devices are updated to the latest security patches provided by Google.
What is the risk associated with CVE-2025-26418?
CVE-2025-26418 has a risk score of 69, indicating a significant potential impact on user data and device security.
What types of devices are affected by CVE-2025-26418?
CVE-2025-26418 affects Google Android devices utilizing the CarDevicePolicyService.
What is the main issue with CVE-2025-26418?
The main issue with CVE-2025-26418 is a missing permission check that allows local escalation of privilege when adding an account to a managed device.