{"id":"ASB-A-341253275","details":"In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-341253275","CVE-2025-26424"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/1b4ee554c8234d1ac16105c92fee2ea0803b8a39"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-05-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271","target":{"function":"putIntoVpnProfileStore","file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false,"digest":{"function_hash":"163713441365363912584104322234018597959","length":123},"id":"ASB-A-341253275-61bb2164"},{"target":{"function":"getFromVpnProfileStore","file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false,"digest":{"function_hash":"143716717230703658895682431182652211845","length":91},"id":"ASB-A-341253275-6e956174","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271"},{"digest":{"function_hash":"143716717230703658895682431182652211845","length":91},"id":"ASB-A-341253275-774c56eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271","target":{"function":"removeFromVpnProfileStore","file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false},{"digest":{"function_hash":"143716717230703658895682431182652211845","length":91},"id":"ASB-A-341253275-9d25af69","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271","target":{"file":"services/core/java/com/android/server/VpnManagerService.java","function":"listFromVpnProfileStore"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271","target":{"file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false,"digest":{"line_hashes":["89177565748140742846596485347557172665","69672141588429440174389020656775169262","121564297782914381017144410341357221508","230925103545592616599657204099487323153","90058151703523503278551915592415381970","175313112128171833383782748455567757622","210439795589587658505593487629836043476","142085562056558224272608357421829156057","170301652449558893383762645561964714134","300105966508058651156827935224526542097","237709588278930753572235568373351899711","227860711991022564722990800753000739145","237406576711083165168522472114623184734","40632532675059611607213447171694335555","142269596827539333111656844013432754992","174873154413613534900568315555059939904","62011651440939353198224124053480914172","301496942145015685092192406822959832511","234830734070820355563160105461540859399"],"threshold":0.9},"id":"ASB-A-341253275-c2a69a5b","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341253275.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26","target":{"file":"services/core/java/com/android/server/VpnManagerService.java","function":"removeFromVpnProfileStore"},"deprecated":false,"digest":{"length":91,"function_hash":"143716717230703658895682431182652211845"},"id":"ASB-A-341253275-2b1c34ef"},{"deprecated":false,"digest":{"line_hashes":["89177565748140742846596485347557172665","69672141588429440174389020656775169262","121564297782914381017144410341357221508","230925103545592616599657204099487323153","90058151703523503278551915592415381970","175313112128171833383782748455567757622","210439795589587658505593487629836043476","142085562056558224272608357421829156057","170301652449558893383762645561964714134","300105966508058651156827935224526542097","237709588278930753572235568373351899711","227860711991022564722990800753000739145","237406576711083165168522472114623184734","40632532675059611607213447171694335555","142269596827539333111656844013432754992","174873154413613534900568315555059939904","62011651440939353198224124053480914172","301496942145015685092192406822959832511","234830734070820355563160105461540859399"],"threshold":0.9},"id":"ASB-A-341253275-38fdaf52","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26","target":{"file":"services/core/java/com/android/server/VpnManagerService.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26","target":{"file":"services/core/java/com/android/server/VpnManagerService.java","function":"getFromVpnProfileStore"},"deprecated":false,"digest":{"length":91,"function_hash":"143716717230703658895682431182652211845"},"id":"ASB-A-341253275-71d4a0f9"},{"target":{"function":"putIntoVpnProfileStore","file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false,"digest":{"length":123,"function_hash":"163713441365363912584104322234018597959"},"id":"ASB-A-341253275-78c1416e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26"},{"digest":{"function_hash":"143716717230703658895682431182652211845","length":91},"id":"ASB-A-341253275-a3739a80","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26","target":{"function":"listFromVpnProfileStore","file":"services/core/java/com/android/server/VpnManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26"],"severity":"High","spl":"2025-05-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341253275.json"}}],"schema_version":"1.9.0"}