{"id":"ASB-A-333681693","details":"In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-333681693","CVE-2025-0087"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/4c269d7b0ec71951f773844b2a325e556f982a9c"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/585d5d6835dd2ddd65316fbbabd714c140da20fa","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"242683011036438429342352847964337614769","length":3832},"id":"ASB-A-333681693-43f9aabd"},{"digest":{"line_hashes":["226539328771947937438867499286202553777","128182404893194415408045296704122750548","131481432215581295571992698494399908966","58621027642444825842784308185130400195","199505949288426174741368538261644591719","264161942589650726092126966092443708262","213303611220441465108637146896255335873","146826521238881401794650207391374591278","139331100715896940561689173889040186387","107706092008188001206620109470412009020","49505901022145429097985022115802020162","61548140088371532993483124328995166210","235181517637232330596128822543034019673","281707485734063334869934073148782235607","200938997849739993552854236564981924543","61193478084274913025145721147151914555","11119856135425521479478086121748634071","36056746438926321259586731742855787738","89564003875324413171558345015596283511","336686012944365615830869366575145117496","323489933819692478040324856745487419193","108398574971251375865312675499366583594","19571880227884009085775074057022930893","330033236943813276107820942169263108625"],"threshold":0.9},"id":"ASB-A-333681693-57fc03ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/585d5d6835dd2ddd65316fbbabd714c140da20fa","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/585d5d6835dd2ddd65316fbbabd714c140da20fa"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-333681693.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3bcfb940869219e379c0100e3f7c90b4daa46516"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"311454146115973663917991245813906054878","length":3863},"id":"ASB-A-333681693-8abe38a4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3bcfb940869219e379c0100e3f7c90b4daa46516"},{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java"},"deprecated":false,"digest":{"line_hashes":["226539328771947937438867499286202553777","128182404893194415408045296704122750548","131481432215581295571992698494399908966","58621027642444825842784308185130400195","199505949288426174741368538261644591719","264161942589650726092126966092443708262","213303611220441465108637146896255335873","146826521238881401794650207391374591278","139331100715896940561689173889040186387","107706092008188001206620109470412009020","49505901022145429097985022115802020162","61548140088371532993483124328995166210","235181517637232330596128822543034019673","281707485734063334869934073148782235607","200938997849739993552854236564981924543","61193478084274913025145721147151914555","11119856135425521479478086121748634071","36056746438926321259586731742855787738","89564003875324413171558345015596283511","336686012944365615830869366575145117496","323489933819692478040324856745487419193","108398574971251375865312675499366583594","19571880227884009085775074057022930893","330033236943813276107820942169263108625"],"threshold":0.9},"id":"ASB-A-333681693-d11be3fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3bcfb940869219e379c0100e3f7c90b4daa46516"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-333681693.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":3453,"function_hash":"76213129383381897343100061884703365797"},"id":"ASB-A-333681693-1f3dbaf8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2d41286d6842b9bd19cd147c57e4f0631a6f798a","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java","function":"onCreate"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2d41286d6842b9bd19cd147c57e4f0631a6f798a","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["328936948513556325927976811060800877617","174760462338680410395634342065634534738","256444957349224662929658674581948890470","329643250220091948918545597765491613050","153397218751441293720439795237062970464","233807460926611837190693891857192799493","151869911743838694737980644498001062757","200938997849739993552854236564981924543","216968072674477350412919701554543735085","320108155360347866818430645633462933912","62898023952813435303310008578329148948","251464919893242259261635574464270018455","86972210004767523422780585715687135168","71878994855942255996645455098177711216","153551245384849571726198800743890646695","108398574971251375865312675499366583594","19571880227884009085775074057022930893","222257891830276747359375193832794397922"]},"id":"ASB-A-333681693-f491283c","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2d41286d6842b9bd19cd147c57e4f0631a6f798a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-333681693.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a30de548524bc2d73ad3bd8b18697a59ac6ffc32"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a30de548524bc2d73ad3bd8b18697a59ac6ffc32","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java"},"deprecated":false,"digest":{"line_hashes":["153397218751441293720439795237062970464","233807460926611837190693891857192799493","151869911743838694737980644498001062757","200938997849739993552854236564981924543","61193478084274913025145721147151914555","11119856135425521479478086121748634071","36056746438926321259586731742855787738","89564003875324413171558345015596283511","336686012944365615830869366575145117496","323489933819692478040324856745487419193","108398574971251375865312675499366583594","19571880227884009085775074057022930893","330033236943813276107820942169263108625"],"threshold":0.9},"id":"ASB-A-333681693-640f1088","signature_type":"Line"},{"deprecated":false,"digest":{"length":3280,"function_hash":"134719885038114671145517187606102306629"},"id":"ASB-A-333681693-75bc1ff1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a30de548524bc2d73ad3bd8b18697a59ac6ffc32","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/UninstallerActivity.java","function":"onCreate"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-333681693.json"}}],"schema_version":"1.9.0"}