CVE-2025-26454: High severity Google Android vulnerability
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26454?
CVE-2025-26454 has a high severity rating as it allows local escalation of privilege without requiring additional execution permissions.
How do I fix CVE-2025-26454?
To fix CVE-2025-26454, update your Google Android device to the latest version that addresses this vulnerability.
Which versions of Android are affected by CVE-2025-26454?
CVE-2025-26454 affects Google Android versions 13.0, 14.0, and 15.0.
Does CVE-2025-26454 require user interaction for exploitation?
No, CVE-2025-26454 can be exploited without any user interaction.
What kind of attack can occur due to CVE-2025-26454?
CVE-2025-26454 can lead to unauthorized access to data belonging to other users, resulting from a confused deputy issue.