{"id":"ASB-A-291281543","details":"In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-291281543","CVE-2025-32319"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/70ab82c4546aa893682a4507664dc2c471d6cd95"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-291281543-7c98f0cf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"line_hashes":["276175483918703643267763319727672269636","114195431026456258179721833469482479710","296396136293484807404839773138533120864","82121813933857842291480403617967861462"],"threshold":0.9}},{"digest":{"line_hashes":["93299813471410581969135562935949905153","15472191267997321310275476709132526577","331422874673880489244790870663492104578","33723722171494134271822092619579944937"],"threshold":0.9},"id":"ASB-A-291281543-7f65acbe","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec","target":{"function":"ensureBound","file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"function_hash":"284769961671316759783773943984793267599","length":583},"id":"ASB-A-291281543-b48606c7","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-291281543-dc565d9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java","function":"ensureBound"},"deprecated":false,"digest":{"function_hash":"207560831244109959545212607114023295396","length":614}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec","https://android.googlesource.com/platform/frameworks/base/+/808e070acf5678086706c62fb876c63fb00303cd","https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-291281543.json"}},{"package":{"name":"platform/vendor/google_shared/build/release","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/vendor/google_shared/build/release/+/1759abed172b1f1ee3e5ed65739914f314b60943"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-291281543.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"ensureBound","file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"length":614,"function_hash":"207560831244109959545212607114023295396"},"id":"ASB-A-291281543-30827104","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276175483918703643267763319727672269636","114195431026456258179721833469482479710","296396136293484807404839773138533120864","82121813933857842291480403617967861462"]},"id":"ASB-A-291281543-cd981f5f","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-291281543.json"}}],"schema_version":"1.9.0"}