{"id":"ASB-A-341688848","details":"In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-341688848","CVE-2024-49722"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/8cba0e8bcfc291977f33f14fba0bd2b7f7fe8f6c"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/2b4d662a462c6b0269a6e6035ce443ec29fd860e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e","target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java","function":"showAvatarPicker"},"deprecated":false,"digest":{"length":418,"function_hash":"66252267982984076039731208061947608083"},"id":"ASB-A-341688848-3d59d7b2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e","target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"},"deprecated":false,"digest":{"line_hashes":["154770951609797451940987862552557479039","218270295055629904027070469533680274829","329718296283725824123553602088403096699","173836244179821243033474735718348316364","121546223260715733684130670385522693067","135193467781791317406752509003365463482","188036491421487214446849389566803674180","284029106079095197665407380999538471599"],"threshold":0.9},"id":"ASB-A-341688848-4ac682c4","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e"],"severity":"High","spl":"2025-04-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341688848.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-04-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922","target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"},"deprecated":false,"digest":{"line_hashes":["21012297230397027758153145274893701940","57287418287093106570617455836807851378","38713462718029103542859251567200340265","328972366237784921290593555927293959860","183557868432084850548757929169437574650","105891697278902170243061600685028799279","138035147008356944918942224769818723366","220101719720662612098877797974864924290","33173686287185361422756979999976859090"],"threshold":0.9},"id":"ASB-A-341688848-0865610e","match_only_versions":["15"]},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495","target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java","function":"showAvatarPicker"},"deprecated":false,"digest":{"length":418,"function_hash":"66252267982984076039731208061947608083"},"id":"ASB-A-341688848-a058b735"},{"target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java","function":"showAvatarPicker"},"deprecated":false,"digest":{"function_hash":"69932913096597948457968943615175847184","length":653},"id":"ASB-A-341688848-b8093c0f","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922"},{"id":"ASB-A-341688848-b892010a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495","target":{"file":"packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"},"deprecated":false,"digest":{"line_hashes":["154770951609797451940987862552557479039","218270295055629904027070469533680274829","329718296283725824123553602088403096699","173836244179821243033474735718348316364","121546223260715733684130670385522693067","135193467781791317406752509003365463482","188036491421487214446849389566803674180","284029106079095197665407380999538471599"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495","https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341688848.json"}}],"schema_version":"1.9.0"}