{"id":"ASB-A-191743558","details":"In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in the code. This could lead to local escalation of privilege where the default assistant app is  automatically granted ROLE_ASSISTANT with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-191743558","CVE-2025-26444"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/c439c7e75e73056e6201fa4f4fe340e715196182"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ba9625e664c76943448ce5b7d97e3b381e71710d","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["18821684757254926990280607860008172982","139840966649269522791898285785452267293","315092234019680884537506538565341346552","58020125161028357005057974212387437290","244358793272881065876483478741034219616","307021397261644951731153291077143973674","67399807452128116897124434211020171075","139188645249593050666559919697204848365","165593933992750819914297179073838435459","256478532399098418144991520562724342281","59478226001948527677859696019854527681","247859164057496948849173274743867921787","18585359427606112274547513649901710219","54367012940565072129042490789229908909","138295755771195710684676945852734259432","300496516844411826331410127420122381880","195688497058848058146876816582140362089","66866868743865279036580801803109303054","288350266245498398950420668425189977547","264622059756258503130654309248837387376"],"threshold":0.9},"id":"ASB-A-191743558-411355af"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ba9625e664c76943448ce5b7d97e3b381e71710d","target":{"function":"onHandleForceStop","file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"function_hash":"138110207219768810180559304153366495464","length":1421},"id":"ASB-A-191743558-ea5e5e37"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ba9625e664c76943448ce5b7d97e3b381e71710d"],"severity":"High","spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191743558.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["18821684757254926990280607860008172982","139840966649269522791898285785452267293","315092234019680884537506538565341346552","58020125161028357005057974212387437290","244358793272881065876483478741034219616","307021397261644951731153291077143973674","67399807452128116897124434211020171075","139188645249593050666559919697204848365","165593933992750819914297179073838435459","256478532399098418144991520562724342281","59478226001948527677859696019854527681","247859164057496948849173274743867921787","18585359427606112274547513649901710219","54367012940565072129042490789229908909","138295755771195710684676945852734259432","300496516844411826331410127420122381880","195688497058848058146876816582140362089","66866868743865279036580801803109303054","288350266245498398950420668425189977547","264622059756258503130654309248837387376"],"threshold":0.9},"id":"ASB-A-191743558-47c48428","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1ca358e20d17bf676223620be2d532c2d2619d1d"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1ca358e20d17bf676223620be2d532c2d2619d1d","target":{"function":"onHandleForceStop","file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"function_hash":"138110207219768810180559304153366495464","length":1421},"id":"ASB-A-191743558-feb95b86","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1ca358e20d17bf676223620be2d532c2d2619d1d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191743558.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9544903ba880ae7acd8096d1a9c3b48965429339"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-191743558-2b23fd31","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9544903ba880ae7acd8096d1a9c3b48965429339","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["18821684757254926990280607860008172982","139840966649269522791898285785452267293","315092234019680884537506538565341346552","58020125161028357005057974212387437290","244358793272881065876483478741034219616","307021397261644951731153291077143973674","67399807452128116897124434211020171075","139188645249593050666559919697204848365","165593933992750819914297179073838435459","256478532399098418144991520562724342281","59478226001948527677859696019854527681","247859164057496948849173274743867921787","18585359427606112274547513649901710219","54367012940565072129042490789229908909","138295755771195710684676945852734259432","300496516844411826331410127420122381880","195688497058848058146876816582140362089","66866868743865279036580801803109303054","288350266245498398950420668425189977547","264622059756258503130654309248837387376"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/9544903ba880ae7acd8096d1a9c3b48965429339","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"onHandleForceStop"},"deprecated":false,"digest":{"length":1421,"function_hash":"138110207219768810180559304153366495464"},"id":"ASB-A-191743558-7a5451b0","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191743558.json"}}],"schema_version":"1.9.0"}