{"id":"ASB-A-337774836","details":"In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-337774836","CVE-2025-26435"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/9dc0dd2c50ceb30ca5062ff3a02e48a8b4165863"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/settings/security/ContentProtectionTogglePreferenceController.java","function":"updateState"},"deprecated":false,"digest":{"length":396,"function_hash":"178772821437044671368461220834367232970"},"id":"ASB-A-337774836-0869afde","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/baf503050fc615c7f663ad09e5adb5ab7e7d99dc"},{"target":{"file":"src/com/android/settings/security/ContentProtectionTogglePreferenceController.java"},"deprecated":false,"digest":{"line_hashes":["23711293699501863784118794929569413548","25438287924212247658772188015551403265","272335625482017964206227763798719803994","268766867470797680073392046456207230271","101177561941442979732000305087204357315","299893934923863190506642489540768999050","51896521754327684075884495202685058216","219286521362033844097925689090791309388"],"threshold":0.9},"id":"ASB-A-337774836-9c07e091","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/baf503050fc615c7f663ad09e5adb5ab7e7d99dc"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/baf503050fc615c7f663ad09e5adb5ab7e7d99dc"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-337774836.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ef16a8cbef5e0987a37c2fa9e5091672a3c8e4ab","target":{"function":"updateState","file":"src/com/android/settings/security/ContentProtectionTogglePreferenceController.java"},"deprecated":false,"digest":{"function_hash":"178772821437044671368461220834367232970","length":396},"id":"ASB-A-337774836-4cddfe70","signature_type":"Function"},{"id":"ASB-A-337774836-50c54e1f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ef16a8cbef5e0987a37c2fa9e5091672a3c8e4ab","target":{"file":"src/com/android/settings/security/ContentProtectionTogglePreferenceController.java"},"deprecated":false,"digest":{"line_hashes":["23711293699501863784118794929569413548","25438287924212247658772188015551403265","272335625482017964206227763798719803994","268766867470797680073392046456207230271","101177561941442979732000305087204357315","299893934923863190506642489540768999050","51896521754327684075884495202685058216","219286521362033844097925689090791309388"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/ef16a8cbef5e0987a37c2fa9e5091672a3c8e4ab"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-337774836.json"}}],"schema_version":"1.9.0"}